Internet-facilitated drugs trade An analysis of the size, scope and the role of the Netherlands Kristy Kruithof, Judith Aldridge, David Décary-Hétu, Megan Sim, Elma Dujso, Stijn Hoorens For more information on this publication, visit www.rand.org/t/RR1607
Published by the RAND Corporation, Santa Monica, Calif., and Cambridge, UK
R® is a registered trademark.
© 2016 WODC, Ministerie van Veiligheid en Justitie Cover image shared by Jo Naylor via Flickr; CC BY 2.0.
RAND Europe is an independent, not-for-profit policy research organisation that aims to improve policy and decisionmaking in the public interest through research and analysis. RAND’s publications do not necessarily reflect the opinions of its research clients and sponsors.
All rights reserved. No part of this book may be reproduced in any form by any electronic or mechanical means (including photocopying, recording, or information storage and retrieval) without permission in writing from the sponsor.
Support RAND Make a tax-deductible charitable contribution at www.rand.org/giving/contribute
www.rand.org www.rand.org/randeurope
Preface
The potential role of the Internet in facilitating drugs trade first gained mass attention with the rise and fall of Silk Road; the first major online market place for illegal goods on the dark web. After Silk Road was taken down by the FBI in October 2013, it was only a matter of weeks before copycats filled the void. Today, there are around 50 so-called cryptomarkets and vendor shops where vendors and buyers find each other anonymously to trade illegal drugs, new psychoactive substances, prescription drugs and other goods and services. But it is not just the obscure parts of the Internet where drugs are on offer. There are numerous web shops, easily found by search engines, which offer designer drugs labelled as ‘research chemicals’. The Netherlands occupies a crucial position in European illicit drug markets. Data from the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA 2016a) suggested it is the main producer of MDMA, ecstasy and herbal cannabis and a key distribution hub for cannabis resin and cocaine. Whether the pivotal role of the Netherlands also extents online, has yet been unclear. While there is considerable attention for these new trends in drug markets, the evidence on their size, shape and evolvement is fairly limited. The Netherlands Ministry of Security and Justice has commissioned, through the Research and Documentation Centre (Wetenschappelijk Onderzoek- en Documentatiecentrum, WODC), RAND Europe a study to provide a firmer evidence base to this phenomenon and, in particular, the role of the Netherlands. In this document, we analyse the size and scope of Internet-facilitated drugs trade both on the so-called clear and dark web, paying special attention to the Netherlands, and delineate potential avenues for law enforcement for detection and intervention. To this end, RAND Europe has collaborated with Judith Aldridge (University of Manchester) and David Décary-Hétu (University of Montreal). The views expressed in this document are those of the authors alone and do not represent those of the Ministry of Security and Justice. The authors are fully responsible for any errors that may have occurred. RAND Europe is an independent not-for-profit policy research organisation that aims to improve policy and decision-making in the public interest through research and analysis. This report has been peer- reviewed in accordance with RAND’s quality assurance standards. For more information about RAND Europe or this document, please contact Stijn Hoorens ([email protected]). RAND Europe RAND Europe Rue de la Loi 82, Bte 3 Westbrook Centre, Milton Road Brussels 1040 Cambridge CB4 1YG Belgium United Kingdom Tel. +32 2669 2400 Tel. +44 1223 353 329
iii
Table of Contents
Preface ...... iii
Table of Contents ...... v
Figures ...... vii
Tables ...... ix
Boxes ...... xi
Samenvatting ...... xiii
Summary ...... xxiii
Acknowledgements ...... xxxi
Glossary ...... xxxiii 1. Introduction ...... 1 1.1. Objectives and scope ...... 2
1.2. Research questions ...... 2
1.3. Structure of this report ...... 4 2. Methodology ...... 5 2.1. Literature review ...... 6
2.2. In-depth interviews ...... 9
2.3. Quantitative analysis of cryptomarket data ...... 11
2.4. Case file analysis ...... 20 3. An introduction to Internet-facilitated drugs trade ...... 21 3.1. Drugs trade via cryptomarkets ...... 21
3.2. Trends in drugs trade via cryptomarkets ...... 27
3.3. Drugs trade and the clear net ...... 29 4. The size and shape of Internet-facilitated drugs trade ...... 33 4.1. Previous studies reporting on the size and shape of Internet-facilitated drugs trade ...... 34
4.2. The number and size of online marketplaces for drugs ...... 35
v 4.3. Types of drugs offered via Internet...... 38
4.4. Revenues of drugs trade ...... 41
4.5. Wholesale versus retail ...... 45
4.6. Volumes of drugs on offer ...... 49
4.7. Other goods and services ...... 50
4.8. Trends in Internet-facilitated drugs trade ...... 54
4.9. In sum ...... 61 5. Shipping routes ...... 63 5.1. Country of origin of drugs traded and vendors operating from the Netherlands ...... 63
5.2. Data on demand side of Internet-facilitated drugs trade ...... 69
5.3. In sum ...... 73 6. Actors involved in Internet-facilitated drugs trade ...... 75 6.1. Overview of actors involved in Internet-facilitated drugs trade ...... 75
6.2. Vendor characteristics and motives ...... 77
6.3. Buyer characteristics, motives and modus operandi ...... 81
6.4. In sum ...... 87 7. Detection and intervention of Internet-facilitated drugs trade ...... 89 7.1. Scope of this chapter ...... 89
7.2. Four modes of detection and intervention ...... 90
7.3. Lessons for detection and intervention of Internet-facilitated drugs trade ...... 97 8. Conclusions ...... 99 References ...... 109
Appendix A: Drug categories ...... 121
Appendix B: Search protocol ...... 123
Appendix C: Overview of studies that collected quantitative information on online drug markets ...... 129
Appendix D: Bibliography of identified literature ...... 139
Appendix E: List of interviewees ...... 161
Appendix F: Interview topic guide ...... 163
vi
Figures
Figure 3.1. Screen shot of drug listings on AlphaBay Market ...... 22 Figure 3.2. Screen shot of a clear net website offering ‘research chemicals’ ...... 30 Figure 4.1. Distribution of estimated revenues across vendors ...... 59
vii
Tables
Table 1.1. Research questions ...... 3 Table 2.1. Overview of study scope and methodologies ...... 6 Table 2.2. List of interviewees ...... 10 Table 2.3. Descriptive statistics of cryptomarkets ...... 12 Table 4.1. Distribution of the listings on active cryptomarkets in January/February 2016 ...... 37 Table 4.2. Categories of drug listing for sale (‘All’ and ‘Dutch’ only drug listings) ...... 39 Table 4.3. Sales (estimated monthly transactions and revenue) across drug categories (‘All’ and ‘Dutch’ only drug listings) ...... 43 Table 4.4. Estimated total minimum retail value of the illicit market for the main drug types in the EU (in billions EUR, USD and per cent) ...... 44 Table 4.5. Distribution of drug listing prices within four price categories ('All' and 'Dutch' only drug listings) ...... 46 Table 4.6. Transactions, revenues and market share of drug listings ('All' and 'Dutch' only drug listings) ...... 47 Table 4.7. Sales (estimated monthly transactions and revenue) across drug categories for wholesale priced drugs only (over $1,000) ('All' and 'Dutch' only drug listings) ...... 48 Table 4.8. Mean weight (g) of exemplar drugs in four price categories ('All' and 'Dutch' only listings) ... 49 Table 4.9. Volume (in grams) traded on marketplaces over the previous month (weight*transactions) for exemplar drugs ('All' (A) and 'Dutch' (B) only listings) ...... 50 Table 4.10. Sales (estimated monthly transactions and revenue) for goods supporting drug production, supply and use ('All' and 'Dutch' only listings) ...... 51 Table 4.11. Items coded as precursors ...... 51 Table 4.12. Other supporting goods and services ...... 52 Table 4.13. Correlation between the different vendor activities ...... 53 Table 4.14. Distribution of vendors’ activities ...... 54 Table 4.15. Trends in categories of drug listed: Silk Road September 2013 to multiple markets January 2016 ...... 55 Table 4.16. Number of listings within four price categories: Silk Road September 2013 to multiple markets January 2016 ...... 55
ix Table 4.17. Revenues and market share: Silk Road September 2013 to multiple markets January 2016 .. 56 Table 4.18. Sales (estimated monthly transactions and revenue) across drug categories, Silk Road September 2013 to multiple markets January 2016 ...... 57 Table 4.19. Trends relating to cryptomarket vendors between September 2013 (SR1) and January 2016 (All cryptomarkets) ...... 58 Table 4.20. Prevalence of email information in listings ...... 61 Table 5.1. Countries from which drug vendors operate: vendors, transactions and revenue ...... 64 Table 5.2. Number of online shops selling NPS ...... 68 Table 5.3. Distribution of transactions and revenues across regions shipped to (All drug listings) ...... 70 Table 5.4. Most common shipping routes on cryptomarkets (All drug listings) ...... 70 Table 5.5. Examples of studies that commented on or had details related to the size of the buyer population ...... 72 Table 6.1. Number of arrests by role and age profile for cryptomarkets, excluding non-drugs ...... 78 Table 6.2. Number of arrests for cryptomarkets by role and country, excluding non-drugs ...... 79 Table A.1.Drug categories…………………………………………………………………………….121 Table B.1. Search strategy…………………………………………………………………………….124 Table B.2. Additional websites searched………………………………………………………………127 Table C.1. Overview of studies that collected quantitative information on drug markets on the dark net...………………………………………………………………………………………… 129 Table C.2. Overview of studies that collected information on clear net markets……………………..134 Table E.1. List of interviewees……………………………………………………………………...161
x
Boxes
Box 2.1. Steps for conducting the literature review ...... 8 Box 2.2. Key focus group questions ...... 10 Box 4.1. The snapshot methodology ...... 35 Box 7.1. Examples of law enforcement interventions ...... 95 Box 7.2. Possible consequences of taking down online marketplaces ...... 96
xi
Samenvatting
Het internet heeft over de afgelopen decennia een aanzienlijke impact gehad op een aantal sectoren in de economie. E-commerce heeft de efficiëntie van productieketens verbeterd, de toegang tot internationale markten vereenvoudigd en de transparantie voor consumenten verbeterd. Dat het internet ook een rol kan spelen bij het faciliteren van drugshandel werd voor het eerst echt duidelijk door het succes van Silk Road: de eerste grote online illegale marktplaats op het zogenaamde dark web. Silk Road werd door de FBI neergehaald in oktober 2013, maar andere, zeer vergelijkbare, markten vulden die ruimte alweer binnen enkele weken. Vandaag de dag zijn er ongeveer 50 zogenoemde cryptomarkten en webshops die alleen toegankelijk zijn met behulp van encryptiesoftware. We gebruiken de term ‘cryptomarkten’, maar er wordt ook wel verwezen naar ‘dark net markten’ (DNMs). Cryptomarkten lijken qua uiterlijk veel op online markplaatsen, zoals Marktplaats.nl of eBay, ook omdat het mogelijk is voor gebruikers om naar advertenties te zoeken en deze vergelijken en om verkopers te beoordelen met feedback. Cryptomarkten brengen verkopers en kopers samen, zodat ze onder pseudoniem illegale drugs, nieuwe psychoactieve stoffen (NPS), medicijnen en andere, vaak illegale goederen en diensten kunnen verhandelen. Het zijn echter niet alleen de donkere krochten van het internet waar drugs worden aangeboden. Er zijn talloze webwinkels op het open internet (het zogenoemde clear net) die gemakkelijk te vinden zijn met zoekmachines en die voornamelijk NPS, ook wel bekend als designer drugs, aanbieden die (nog) niet officieel zijn verboden. Buiten het internet, heeft Nederland een centrale positie in Europese illegale drugsmarkten. Volgens het Europese Monitoring Centrum voor Drugs en Drugverslaving (EMCDDA) is Nederland de belangrijkste producent van xtc en cannabis en een belangrijke doorvoerhaven voor de distributie van hasj en cocaïne. Of die cruciale rol voor Nederland zich ook uitstrekt tot het handel via het internet is nog onduidelijk. Er is voldoende media-aandacht voor internet-gefaciliteerde drugshandel, maar harde cijfers over de omvang, aard en ontwikkeling zijn er nauwelijks.
Doelstelling en methodes
De studie beoogt de omvang en het bereik van de drugshandel gefaciliteerd door het internet te onderzoeken (Sectie 1.1) Dit rapport beoogt de rol van het internet bij het faciliteren van drugshandel te onderzoeken. Het is opgesteld in opdracht van het Wetenschappelijk Onderzoek- en Documentatiecentrum (WODC), het
xiii RAND Europe Internet-facilitated drugs trade
onafhankelijke onderzoekscentrum van het Ministerie van Veiligheid en Justitie. Speciale aandacht gaat hierbij uit naar de rol van Nederlandse actoren in het faciliteren van deze handel. De algemene doelstellingen van dit onderzoek waren: • Het inschatten van de omvang en karakteriseren van de aard van drugshandel die door het internet wordt gefaciliteerd; • Het vaststellen van de rol van Nederland in de drugshandel die door het internet wordt gefaciliteerd; en • Het verkennen van de mogelijkheden voor de opsporing en interventie door rechtshandhaving.
De aandacht ging hierbij zowel uit naar drugshandel via cryptomarkten als drugshandel via het clear net. Hieronder wordt toegelicht dat de nadruk van de kwantitatieve analyse zal liggen op cryptomarkten.
We gebruiken een mix van kwalitatieve en kwantitatieve methoden (Hoofdstuk 2) Om deze doelstellingen te bereiken zijn verscheidene kwantitatieve en kwalitatieve onderzoeksmethoden toegepast: een literatuuronderzoek, interviews met experts en vertegenwoordigers van rechtshandhaving; verzameling en analyse van cryptomarketgegevens; en een onderzoek van politiedossiers. De nadruk van dit onderzoek lag op drugshandel via cryptomarkten. De kwantitatieve analyse van de omvang van dit fenomeen werd uitgevoerd door het scrapen en analyseren van gegevens van acht van de grootste cryptomarkten. Deze methoden indexeren alle pagina’s op een webdomein en halen daar de relevante informatie uit. Ironisch genoeg is het eenvoudiger om informatie te verkrijgen via web scraping- methoden op cryptomarkten, dan op het clear net. Ten eerste, het aantal beschikbare cryptomarkten is veel kleiner dan het aantal NPS webwinkels. Ten tweede, clear net gegevens bevatten enkel informatie over de beschikbare producten en hun prijzen, maar niet over het aantal gemaakte transacties. Op cryptomarkten kan het aantal gegeven feedbacks worden gebruikt als proxy voor het aantal transacties. De kwantitatieve bevindingen zijn aangevuld en vergeleken met de bevindingen uit de literatuur, interviews met experts en vertegenwoordigers van rechtshandhaving en een focusgroep met vertegenwoordigers van rechtshandhaving. Verkoop van NPS via webshops op het clear net is voornamelijk in kaart gebracht met behulp van literatuuronderzoek en interviews. Waar mogelijk, zijn resultaten geïllustreerd met bevindingen uit de analyse van de Nederlandse politiedossiers over een neergehaalde cryptomarkt.
De aard en omvang van drugshandel die gefaciliteerd wordt door het internet
Het aantal NPS webshops is de afgelopen jaren sterk gegroeid, maar de omvang van de markt voor NPS op het clear net is onduidelijk (Secties 4.2.2 en 5.1.4) In vergelijking met de handel via cryptomarkten hebben we weinig informatie over de omvang van drugshandel via het clear net verkregen. De onderzoeksliteratuur hierover is relatief beperkt (ondanks dat deze webshops langer bestaan dan cryptomarkten). Desondanks concluderen wij uit onze analyse dat de beschikbaarheid van NPS via webwinkels op het clear net snel is toegenomen in de afgelopen jaren. Een studie uit 2008 telde 60 NPS webshops in de EU, in 2011 werden er 314 geteld en in 2013 wel 651. NPS zijn niet strafbaar gesteld in internationale drugsverdragen, maar kunnen wel mogelijk een gevaar vormen
xiv Internet-facilitated drugs trade RAND Europe
voor de volksgezondheid. NPS mogen online verkocht worden, mits webshops expliciet aangeven dat ze niet geschikt zijn voor consumptie. Uit eerder onderzoek bleek dat talloze dergelijke designer drugs (veelal onder de noemer van ‘research chemicals’) te koop worden aangeboden, zoals synthetische cannabinoïden, opioïden, tryptamines en benzodiazepines. Een precieze inschatting van het aantal gebruikers in Nederland dat deze middelen via het Internet aanschaffen, is echter niet mogelijk gebleken. Maar, volgens literatuur- en interviewgegevens lijkt de verkoop van NPS via clear net webshops minder prominent in Nederland dan in andere Europese landen. De Europese studie I-TREND heeft 19 Nederlandse webwinkels gevonden, in vergelijking met 207 Britse en 72 Poolse. De omzet van deze webshops blijft onduidelijk.
Het internet heeft geleid tot nieuwe business modellen voor drugshandel (Sectie 4.2) Uit ons onderzoek blijkt dat, net als in vele andere legale markten, het internet tot nieuwe business modellen voor drugshandel heeft geleid. Met de opkomst en ondergang van Silk Road 1.0 tussen 2011 en 2013 wonnen cryptomarkten snel aan populariteit. Een maand voordat Silk Road 1.0 werd neergehaald door de FBI, schatten onderzoekers de maandelijkse omzet van drugshandel op meer dan $7 mln. Sindsdien hebben we cryptomarkten zien verschijnen en weer verdwijnen, vaak na exit scams door de eigenaars zelf of door het neerhalen door de politie. Als onderdeel van deze studie hebben we zo’n 50 actieve cryptomarkten en webshops geïdentificeerd op het dark web. Negentien daarvan hebben elk ten minste 400 advertenties. De drie grootste markten, AlphaBay, Nucleus en Dreammarket, bevatten ongeveer 65 procent van alle advertenties voor alle producten en diensten tezamen. Voor deze studie hebben we informatie van acht van de 50 markten gescrapet. Deze acht markten hadden in totaal 105.811 advertenties (voor zowel drugs als andere producten en diensten), wat neerkomt op ongeveer 80 procent van de advertenties op alle 50 cryptomarkten en webshops.
Maandelijks wordt tussen de 14 tot 25 miljoen dollar aan drugs omgezet op cryptomarkten (Sectie 4.4) Uit ons onderzoek blijkt dat van alle advertenties op de acht geanalyseerde cryptomarkten, het in 57 procent van de advertenties om drugs gaat. Onze resultaten geven aan dat de totale maandelijkse omzet op deze markten minimaal $14.2 mln (€12.6 mln) is. Wanneer medicijnen, alcohol en tabak worden weggelaten is de omzet $12.0 mln (€10.6 mln). Vanwege de beperkingen in de methode (uitgelegd in Sectie 2.3.2), verschaffen deze cijfers een ondergrens voor de schatting van de totale omzet. De maximum schatting voor de maandelijkse drugsomzet op alle cryptomarkten komt uit op $25.0 mln (€22.1m), of $21.1m (€18.7) zonder medicijnen, alcohol en tabak. Ondanks verschillende interventies en verstoringen door de politie en verschillende exit scams, bestaan cryptomarkten nog steeds. Het dark web vormt niettemin een nichemarkt voor drugs, want cryptomarkten vertegenwoordigen slechts een fractie van de totale drugsmarkt. Terwijl de totale waarde van de Europese drugsmarkt geschat wordt op ten minste €2 miljard per maand (ten minste €24 mld per jaar in 2013), wijzen onze resultaten voor cryptomarkten wereldwijd slechts richting enkele tientallen miljoenen dollars. Ook in Nederland lijkt de omzet door Nederlandse drugverkopers op cryptomarkten een stuk lager dan de offline omzet.
xv RAND Europe Internet-facilitated drugs trade
Cannabis, opwekkende middelen en xtc vormen 70 procent de omzet op cryptomarkten die in deze studie zijn geanalyseerd (Sectie 4.4) Onze bevindingen laten zien dat er enige continuïteit bestaat in de verhouding waarin verschillende typen drugs worden verkocht op cryptomarkten (op basis van zowel transacties als omzet) sinds 2013. Cannabis levert nog steeds de hoogste omzet op met 31 procent van de totale drugshandel, gevolgd door opwekkende middelen (24 procent, waaronder cocaïne en amfetamine), xtc-achtige drugs (16 procent, waaronder xtc en MDMA), psychedelica (8 procent) en opioïden (6 procent, inclusief heroïne). Het marktaandeel van deze verschillende typen drugs op cryptomarkten is vergelijkbaar met dat in de offline wereld, met name voor opwekkende middelen en cannabis. Wat xtc-achtige drugs betreft, lijken deze echter veel populairder op cryptomarkten dan op straat, want het totale offline marktaandeel in Europa voor xtc is slechts 2 procent. Voor heroïne geldt het omgekeerde. Dit heeft een marktaandeel van ongeveer 28 procent in Europa, terwijl uit onze resultaten blijkt dat het marktaandeel van niet- voorgeschreven opioïden (voornamelijk heroïne) vrij gering is (6 procent). Samenvattend zijn het met name de party drugs of recreatieve middelen (cannabis, xtc, psychedelica) die cryptomarkten domineren. Een mogelijke verklaring voor de verschillen tussen de ‘online’ en ‘offline’ markten kan zijn dat dergelijke aankopen via cryptomarkten doorgaans enige planning vereisen, hetgeen wellicht minder goed past bij het patroon van dagelijks gebruik door bijvoorbeeld heroïneverslaafden.
Hoe verhoudt dit zich tot de begintijd van cryptomarkten?
Cryptomarkten zijn behoorlijk, maar niet explosief gegroeid in de afgelopen paar jaar (Sectie 4.8) Cryptomarkten hebben zich bestand getoond tegen ingrijpen door politie- en overige handhavingsdiensten. Meteen na de ondergang van Silk Road 1.0 in 2013 zagen nieuwe marktplaatsen het levenslicht en deze wonnen snel aan marktaandeel. Maar dit onderzoek laat zien dat drugshandel via cryptomarket sindsdien niet explosief, maar geleidelijk is toegenomen. In vergelijking met analyse van Silk Road data uit september 2013, blijkt dat het markaandeel van de verschillende typen drugs niet wezenlijk is veranderd in 2016. De omzet is sindsdien verdubbeld en het totaal aantal transacties is verdrievoudigd. Cryptomarkten bevatten 5.5 keer zoveel advertenties voor drugs.
Nog steeds niet alleen een eBay voor drugs (Sectie 4.5) Advertenties voor kleine hoeveelheden, onder de $100, vormen het grootste deel van de transacties op de acht geanalyseerde cryptomarkten. Deze transacties dienen hoogstwaarschijnlijk alleen voor persoonlijk gebruik. Deze retail-transacties leveren echter slechts 18 procent van de totale omzet. Dit onderzoek toont aan dat transacties van groothandelhoeveelheden (boven de $1000) nog steeds belangrijk zijn op cryptomarkten. Ze leverden zowel in september 2013 als in januari 2016 bijna een kwart van de totale omzet. De veelgebruikte analogie “een eBay voor drugs” is daarom niet helemaal juist, aangezien eBay bedoeld is als eCommerce platform voor business-to-consumer (B2C) verkoop. Dit is een belangrijke bevinding. Handel op cryptomarkten faciliteert namelijk niet alleen gebruikers toegang tot een breed scala aan middelen. Maar, op basis van het aantal transacties van groothandelhoeveelheden kan men concluderen dat ook veel drugsdealers zich op cryptomarkten begeven om hun voorraad aan te vullen bestemd voor de offline detailhandel. Zodoende kunnen cryptomarkten ook een rol spelen in het verspreiden van een breed scala aan middelen naar lokale offline drugsmarkten.
xvi Internet-facilitated drugs trade RAND Europe
Volgens andere studies zijn er ook voor webshops op het clear net indicaties dat NPS online worden gekocht in groothandelhoeveelheden, die vervolgens in kleine hoeveelheden worden doorverkocht of verspreid als sociale distributie.
Er hebben zich de afgelopen jaren enkele ontwikkelingen voorgedaan op cryptomarkten (Sectie 3.2) Wederzijds vertrouwen tussen verkopers, kopers en beheerders is van cruciaal belang voor het succes van cryptomarkten. Maar dit vertrouwen heeft volgens waarnemers door een reeks lekken in de beveiliging van markplaatsen, voorbeelden van oplichting (scams) en verstoringen en ingrijpen door de politie een deuk opgelopen. Deze gebeurtenissen hebben hun weerslag gehad op de levensduur van individuele cryptomarkten. Desalniettemin heeft dit gereduceerde vertrouwen niet geleid tot een daling van de drugshandel via online marktplaatsen. Door nieuwe innovaties en technologische ontwikkelingen blijft de online drugshandel zich gestaag uitbreiden. Sommige van deze technische innovaties op cryptomarkten zijn gericht op het verminderen van het risico van oplichting voor zowel verkopers als kopers. Hoewel het nog niet op grote schaal wordt gebruikt, vereist het zogenoemde multi-signature escrow dat twee van de drie partijen een transactie goedkeuren. Dat maakt het onmogelijk voor een partij om in zijn eentje met geld te verdwijnen. Verder zijn hier en daar gedecentraliseerde markten ontstaan op basis van peer-to-peer systemen. Deze ontwikkeling staat ook nog in de kinderschoenen, maar dergelijke markten kunnen het risico van exit scams en mogelijk ingrijpen door de politie verminderen, aangezien het onmogelijk zal zijn om het hele systeem neer te halen. Tot slot, het risico van exit scams en de angst dat politiediensten markten zullen neerhalen heeft sommige verkopers ertoe gedreven hun eigen webshop op te zetten op het dark web. Ook bestaan er aanwijzingen dat verkopers hun potentiële klanten benaderen via (versleutelde) email of directe berichten buiten de cryptomarkten om.
Gangbare routes en de rol van Nederland
Verkopers in Angelsaksische landen of West-Europa leveren de meeste omzet (Sectie 5.1) We hebben de routes geanalyseerd van drugs verkocht via cryptomarkten en daarin hebben we in het bijzonder naar de rol van Nederland gekeken. Drugsverkopers op cryptomarkten lijken vanuit tientallen verschillende landen te opereren. Verkopers geven op hun advertenties aan van waaruit de producten worden verstuurd. Deze informatie hebben we als proxy gebruikt voor het thuisland van verkopers. Verkopers die aangeven dat ze de drugs vanuit Nederland verzenden, beschouwen we dus als ‘Nederlandse verkopers’. Dit leidt mogelijk tot een onderschatting van het aantal Nederlandse verkopers, omdat er aanwijzingen zijn dat sommige Nederlandse verkopers hun drugs vanuit het buitenland versturen. Schijnbaar gaan verkopers in dit geval de grens over om vanuit Duitsland of België de pakketjes op de post te doen. Voor zover bekend hebben cryptomarkten zich voornamelijk gemanifesteerd in de Angelsaksische wereld en West-Europa. De meeste verkopers geven aan te opereren vanuit de Verenigde Staten (890), gevolgd door het Verenigd Koninkrijk (338) en Duitsland (225). Maar gezien hun rol in de productie van met name NPS zouden Aziatische landen, zoals India en China, ook vruchtbare voedingsbodems voor deze markten kunnen zijn.
xvii RAND Europe Internet-facilitated drugs trade
Verkopers die aangeven dat ze vanuit de Verenigde Staten drugs verzenden, genereren 36 procent van de totale drugsomzet op de geanalyseerde cryptomarkten. Vergeleken met bevindingen uit 2013 is het marktaandeel van verschillende landen niet veel veranderd, met uitzondering van Australië. Het aandeel van Australische verkopers is namelijk in de afgelopen drie jaar flink gestegen. Andere Angelsaksische (Canada en het Verenigd Koninkrijk) alsmede West-Europese landen (Nederland, Duitsland, Spanje, Frankrijk) leveren ook een substantieel aandeel. Wanneer we verkopers met elkaar vergelijken, is de omzet per verkoper het grootst in Australië. Dit is waarschijnlijk te verklaren doordat de prijzen van drugs in Australië aanzienlijk hoger liggen dan in de overige landen, hetgeen zich waarschijnlijk vertaalt naar een hogere omzet voor verkopers.
De ‘Nederlandse’ drugsomzet is verreweg het grootst per hoofd van de bevolking (Sectie 4.4) Verkopers die aangeven dat ze vanuit Nederland handelen zijn verantwoordelijk voor 8 procent van de totale drugsomzet op de acht geanalyseerde markten. Per hoofd van de bevolking is die omzet 2.4 keer zo groot als de omzet uit het Verenigd Koninkrijk en 4.5 keer zo groot als die van de Verenigde Staten. Dat is misschien niet verwonderlijk gezien de belangrijke rol van Nederland in de productie en doorvoer van drugs in Europa. ‘Nederlandse verkopers’ lijken zich te specialiseren, aangezien driekwart van alle inkomsten gegenereerd door twee typen drugs: xtc-achtige drugs (bijna de helft) en opwekkende middelen (een kwart). Dit patroon lijkt een weerspiegeling van de rol van Nederland in de productie van deze typen drugs. Online verkopers hebben redelijk eenvoudig toegang tot deze middelen en het is bovendien winstgevend vanwege de korte afstand tot productie. Stoffen zoals MDMA kunnen goedkoop in eigen land worden geproduceerd en vervolgens tegen hogere (internationale) prijzen worden doorverkocht. Deze specialisatie is zelfs nog duidelijker als men enkel kijkt naar groothandelhoeveelheden. 82 procent van alle opbrengsten voor ‘Nederlandse’ advertenties van meer dan $1,000 worden gegenereerd door xtc- achtige drugs en opwekkende middelen.
‘Nederlandse verkopers’ spelen nauwelijks een rol in verkoop van cannabis op cryptomarkten (Sectie 4.4) Onze resultaten tonen aan dat het aandeel van de ‘Nederlandse verkopers’ in de cannabisverkoop op de acht cryptomarkten relatief klein is. In elk geval een stuk kleiner dan kan worden verwacht gezien de internationaal prominente rol van Nederland in de wietteelt en in de doorvoer van hasj. Cannabis zorgt slechts voor 10 procent van de totale Nederlandse drugsomzet via cryptomarkten. ‘Nederlandse verkopers’ verzenden ongeveer 11 kilo per maand, slechts 2 procent van de totale omzet voor cannabis die wij hebben vastgesteld op cryptomarkten.
De meest gangbare routes voor drugs via cryptomarkten zijn intra-continentaal (Sectie 5.2) Onze resultaten tonen dat de Verenigde Staten en Oceanië (Australië en Nieuw Zeeland) de twee meest populaire bestemmingen zijn voor drugs op cryptomarkten. Dat wil zeggen, het verkopers zijn graag bereid om drugs daar naartoe te verzenden. Europa komt op de derde plaats met ongeveer $800.000 in omzet van drugs. Het was echter een uitdaging voor deze studie om de populaire routes goed in kaart te brengen. Meer dan de helft van alle drugsomzet heeft een onbekende bestemming. De meest gangbare routes voor drugs zijn die binnen de Verenigde Staten, binnen Europa en binnen Oceanië. Het aandeel van verschillende landen in de drugsroutes valt moeilijk nauwkeurig in te schatten.
xviii Internet-facilitated drugs trade RAND Europe
Er is weinig informatie over de vraagkant van online gekochte drugs (Sectie 5.2) Met betrekking tot de vraagkant van online gekochte drugs in Nederland bevat de literatuur weinig informatie. Er zijn slechts enkele studies naar de herkomst van geconsumeerde drugs en die leveren weinig tot geen bewijs over de aanschaf van drugs via internet door Nederlandse consumenten. De verzamelde data voor deze studie hebben evenmin veel nieuwe inzichten opgeleverd. De gescrapete cryptomarktgegevens bevatten geen informatie over de locatie van kopers, enkel over de landen of continenten waarnaar verkopers bereid zijn hun producten te verzenden. Er waren nauwelijks advertenties door ‘Nederlandse verkopers’ die enkel binnen Nederland wilden verzenden. Inlichtingen van de handhavingsdiensten lijken te bevestigen dat Nederlandse online drugsverkopers voornamelijk aan klanten in het buitenland leveren. Nederlandse cryptomarktconsumenten daarentegen lijken volgens deze inlichtingen voornamelijk drugs uit eigen land kopen.
Er worden ook andere drug-gerelateerde producten en diensten aangeboden, maar de omzet daarvan is relatief laag (Sectie 4.7) Cryptomarkten worden gedomineerd door drugs. Er zijn ook advertenties voor andere producten en diensten, bijvoorbeeld die ter ondersteuning van de productie, levering of gebruik van drugs kunnen dienen. Hierbij kan gedacht worden aan vervalste identiteitsbewijzen, financiële producten en diensten, of apparatuur voor productie. Maar ze brengen relatief weinig geld op. De totale omzet van deze drugs- gerelateerde producten en diensten in januari 2016 was ongeveer 0.2 procent van de totale drugsverkoop. Slechts één op de drie verkopers bood andere producten aan dan drugs en over het algemeen verkochten ze niet ook drugs daarnaast. Nederlandse verkopers op cryptomarkten, daarentegen, verkopen vrijwel altijd drugs.
Actoren en hun modus operandi
De belangrijkste actoren zijn administrators, moderators, ontwikkelaars, verkopers en kopers (Sectie 6.1) Naast het inschatten van de omvang van cryptomarkten geeft dit rapport ook een karakterisering van de verschillende actoren die betrokken zijn bij deze markten. Er zijn verschillende actoren die (bewust of onbewust) betrokken zijn bij internet-gefaciliteerde drugshandel. Op cryptomarkten zijn de volgende actoren te onderscheiden: administrators (uitvoerend management en penningmeester), ontwikkelaars (web design en onderhoud), moderators (medewerkers op de markt), verkopers en kopers. Andere actoren die een ondersteunende rol kunnen spelen (en zich mogelijk niet bewust zijn van hun betrokkenheid) zijn bitcoin wisselaars, Internet Service Providers, leveranciers van legale producten en postdiensten. In dit onderzoek zijn twee actoren (verkopers en kopers) verder uitgelicht. Deze analyse is gebaseerd op literatuuronderzoek, interviews en gegevens uit de Nederlandse politiedossiers.
Hoewel gebaseerd op beperkt bewijs is het aannemelijk dat verkopers jonge mannen zijn uit Engels sprekende of West-Europese landen (Sectie 6.2) Uit beperkt bewijs blijkt dat drugsverkopers op cryptomarkten vaak relatief jonge (onder de 40), opgeleide, IT-vaardige en ondernemingsgezinde mannen zijn afkomstig uit Angelsaksische en West- Europese landen. Engels is de meest gebruikte taal op cryptomarkten, al communiceren sommige verkopers ook in andere talen. Op online drugsmarkten handelen zowel professionele drugsdealers die nauwe banden hebben met de productieketen en de online verkoop van drugs als een extra
xix RAND Europe Internet-facilitated drugs trade inkomstenbron zien als newbies die tot dusver alleen drugs aan vrienden verkochten. Financiële, libertijnse en veiligheidsmotieven liggen ten grondslag aan het besluit om drugs online te verkopen. We hebben geen studies gevonden die informatie bieden over de karakteristieken van verkopers die betrokken zijn bij drugshandel op het clear net.
Kopers worden aangetrokken tot cryptomarkten vanwege een gevoel van verhoogde veiligheid, verbeterde kwaliteit van en diversiteit aan drugs en gemak en snelheid van bezorging (Sectie 6.3) Uit beperkt bewijs blijkt dat kopers op cryptomarkten ook vaak relatief jonge (onder de 40), opgeleide en IT-vaardige mannen uit Angelsaksische en (andere) Europese landen zijn. De meerderheid lijkt te bestaan uit recreatieve drugsgebruikers - sommige beschouwen zichzelf als ‘psychonauten’ - die eerder drugs hebben gebruikt. Kopers lijken verschillende motieven te hebben voor de aanschaf van drugs op online marktplaatsen: een gevoel van verhoogde veiligheid ten aanzien van offline aankopen, verbeterde kwaliteit van en diversiteit aan drugs, anonimiteit, en het gemak en de snelheid van levering. Uit eerder onderzoek blijkt dat kopers tevens de transparantie en volledigheid van productinformatie op cryptomarkten waarderen. Kopers hebben de neiging hun aankopen te baseren op prijs, beschikbare tripverslagen, productdetails, reputatie van verkopers en feedback van andere kopers. Er is momenteel onvoldoende bewijs om definitieve conclusies te trekken over de vraag of de aanwezigheid van online drugsmarkten leidt tot nieuwe actoren die voorheen geen drugs offline kochten of verkochten. Er is tevens onvoldoende bewijs om definitieve conclusies te trekken over de vraag of online drugsmarkten de offline drugsmarkten vervangen.
Wijzen van opsporing en interventie
Er zijn vier brede categorieën van opsporing en interventie (Hoofdstuk 7) Naast preventie en schadebeperking is rechtshandhaving een van de drie pijlers van het Nederlandse drugsbeleid. Anekdotisch bewijs uit de literatuur en interviews geeft aan dat rechtshandhaving een impact heeft gehad op het vertrouwen binnen cryptomarkten. Over het algemeen is de omvang van drugshandel op deze markten echter gegroeid. Eerder onderzoek toont aan dat het verplaatsen van verkopers en kopers naar andere, bestaande cryptomarkten het voornaamste gevolg was van het neerhalen van cryptomarkten. Er wordt verondersteld dat de negatieve impact van scams op het vertrouwen binnen deze online markten misschien wel groter is dan wat rechtshandhaving zou kunnen bereiken. In een aantal artikelen en interviews wordt gewezen op de potentiële voordelen van internet-gefaciliteerde drugshandel in het verminderen van schade geassocieerd met drugsmarkten. Op basis van gegevens uit de interviews en literatuur hebben wij vier brede categorieën op het gebied van opsporing en interventie van internet-gefaciliteerde drugshandel geïdentificeerd: 1. Traditionele onderzoekstechnieken die toegepast worden op de drugsketen (bijv. observaties, undercover operaties); 2. Het opsporen en onderscheppen van post (bijv. samenwerking tussen wetshandhavingsinstanties en postdiensten); 3. Online detectie (bijv. big data technieken, het monitoren van online marktplaatsen, het volgen van geldstromen); en 4. Online verstoring (bijv. neerhalen van online marktplaatsen).
xx Internet-facilitated drugs trade RAND Europe
Internationale samenwerking en coördinatie (en de bijbehorende juridische vraagstukken), capaciteit en middelen, en (technische) mogelijkheden kunnen een faciliterende rol spelen bij het implementeren van bovenstaande strategieën.
xxi
Summary
Over the past two decades, the Internet has had a transformative effect on business models in numerous sectors. e-Commerce has improved efficiency of supply chains, facilitated market access and improved transparency for consumers. The potential role of the Internet in facilitating illicit drugs trade was first highlighted by the success of Silk Road; the first major online market place for illegal goods on the dark web. Silk Road was taken down by the FBI in October 2013, but other, very similar markets filled the void within weeks. Today, there are purportedly around 50 so-called cryptomarkets and vendor shops that can only be accessed by using encryption software to ensure anonymity. We use the term ‘cryptomarkets’, but we note that the term ‘dark net markets’ (DNMs) also becomes more established. Cryptomarkets look similar to regular online market places, such as eBay or Amazon, by allowing their customers to search and compare products and rate vendors. These markets bring vendors and buyers together acting under pseudonyms to trade illegal drugs, new psychoactive substances (NPS), prescription drugs and other, often illegal, goods and services. It is not just the obscure parts of the Internet where drugs are on offer. There are numerous web shops on the clear net, easily found by search engines, which offer mostly NPS, also known as designer drugs that have not been officially banned (yet). The Netherlands occupies a crucial position in European illicit drug markets. Data from the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) suggested it is the main producer of ecstasy and herbal cannabis and a key distribution hub for cannabis resin and cocaine. Whether the pivotal role of the Netherlands also extends to the drugs trade facilitated by the Internet has yet been unclear. While there has been considerable attention paid to the role of the Internet in facilitating drug market from media outlets, the evidence on their size, shape and evolvement is fairly limited.
Objectives and methodologies
The study aims to investigate the size and scope Internet-facilitated drugs trade (Section 1.1) This report aims to investigate the role of the Internet in facilitating drugs trade. It is commissioned by the Research and Documentation Centre (Wetenschappelijk Onderzoek- en Documentatiecentrum, WODC), the independent research arm of the Ministry of Security and Justice in the Netherlands. Special attention will therefore be paid to the role of Dutch actors in facilitating this trade. The overall aims of this study are: • To characterise the scope and the size of Internet-facilitated drugs trade; • To identify the role of the Netherlands in Internet-facilitated drugs trade; and
xxiii RAND Europe Internet-facilitated drugs trade
• To delineate potential avenues for law enforcement for detection and intervention The study considers trade via cryptomarkets as well as drugs trade facilitated by the clear net. For reasons explained below, the emphasis of the quantitative analysis is on cryptomarkets.
We used a mix of qualitative and quantitative methods (Chapter 2) In order to address these objectives, a mix-of quantitative and qualitative methods was applied, consisting of: a review of the literature; in-depth interviews with experts and law enforcement representatives; collection and analysis of cryptomarket data; and a review of police case files. The emphasis of this study was on drugs trade via cryptomarkets. The quantitative assessment of the size and scope of this phenomenon was conducted through collection and analysis of scraped data from eight of the largest cryptomarkets in January 2016. Ironically, it is more straightforward for the researchers to obtain data via web scraping/crawling techniques deployed on cryptomarkets than on the clear net. These techniques identify all pages on a web domain and extract the relevant information. First, because the number of available cryptomarkets is much smaller than that of NPS web shops. And second, because scraped data from the clear net tell us only about substances listed for sale there and their prices, and not the extent to which sales occur. On cryptomarkets, the number of feedbacks can be used as a proxy for transactions. The quantitative findings were complemented with and compared to findings from the literature, interviews with experts and law enforcement officials and a focus group with law enforcement representatives. Trade of NPS via clear net market places was primarily investigated through literature review and interviews. Where possible, the results were illustrated with findings from analysis of Dutch police case files relating to Internet-facilitated drugs trade.
The size and shape of Internet-facilitated drug markets
On the clear net the size of the online market for NPS is unclear, but the number of web shops has grown considerably in recent years (Sections 4.2.2 and 5.1.4) We were unable to learn as much about the undoubtedly growing clear net sales of legal substances, compared to sales via cryptomarkets. The research literature here is comparatively limited (in spite of the fact that these markets have existed for longer than cryptomarkets). Nevertheless, we conclude from our analysis that the availability of NPS via web shops on the clear net has increased quickly in recent years. Previous studies identified 60 web shops in the EU in 2008, 314 in 2011 and 651 in 2013. NPS are not controlled by the international drug conventions, but they may pose a public health threat. They can be sold online, provided web shops indicate explicitly that they are not intended for human consumption. Previous research found that numerous different types of designer drugs (often labelled as research chemicals) were offered for sale, including synthetic cannabinoids, opioids, tryptamines, and benzodiazepines. The size of the buyer population is unclear. Based on literature and interview data, sales of NPS via clear net web shops seemed to be less prominent in the Netherlands than in other European countries. The EU-funded I-TREND study found 19 shops operating from the Netherlands, compared to 207 from the UK and 72 from Poland. These markets are generating an unknown amount of revenue.
xxiv Internet-facilitated drugs trade RAND Europe
The Internet has created new business models for drugs trade (Section 4.2) Overall, we found that – similar to many markets for licit goods – the Internet has created new business models for drugs trade. Cryptomarkets quickly gained popularity between 2011 and 2013 with the rise and fall of Silk Road 1.0. A month before it was taken down by the FBI, researchers estimated monthly revenues for drugs trade on Silk Road 1.0 at more than US$7m. Since then, cryptomarkets have appeared and disappeared again, often following exit scams or take downs. As part of this study, we identified about 50 live cryptomarkets and single-vendor shops on the hidden web. Some 19 of them had at least 400 listings each. The three largest markets, AlphaBay, Nucleus, and Dreammarket, accounted for about 65 per cent of all listings across all products and services. Some eight of the 50 markets identified were scraped for this study, and these eight sites had 105,811 listings (across all products and services), approximately 80 per cent of all listings across all 50 cryptomarkets.
Monthly revenues from drugs on cryptomarkets are in the double-digit million dollars (Section 4.4) Of all products and services on offer, we found that 57 per cent of listings across the scraped cryptomarkets offered drugs. Our results indicate the eight cryptomarkets analysed for the study generate a total monthly revenue of $14.2m (€12.6m) and $12.0m (€ 10.6m) when prescription drugs and alcohol and tobacco are excluded. These figures represent a lower-boundary estimate, due to some limitations of our approach (explained in Section 2.3.2). An upper-boundary estimate for monthly drug revenues via visible listings on all cryptomarkets would be $25.0m (€22.1m), or $21.1m (€18.7) without prescription drugs, alcohol and tobacco. So, despite law enforcement intervention and various exit scams on these marketplaces, cryptomarkets have survived. Yet, they represent a niche part of drugs trade at large, as they constitute a fraction of the total drug market in the offline world. Whereas the total retail value of the European drug market is estimated to amount at least €2bn per month (i.e. at least €24bn annually in 2013), our data suggested monthly revenues for international cryptomarkets in double-digit million dollars. Similarly, for the Dutch context, revenues for ‘Dutch vendors’ on cryptomarkets appeared to be much lower than offline revenues.
Cannabis, stimulants and ecstasy are responsible for 70 per cent of all revenues on cryptomarkets included in this study (Section 4.4) Our findings indicate that the types of drugs sold on cryptomarkets and their relative importance as assessed by sales (transactions and revenues) showed continuity since 2013. Cannabis still generated highest revenues, 31 per cent of all drugs revenues, followed by stimulants (24 per cent, including cocaine and amphetamines), ecstasy-type (16 per cent, including ecstasy and MDMA), psychedelics (8 per cent) and opioids (6 per cent, including heroin). These revenue shares seem to mimic the retail value of different drug types in the offline world, particularly for stimulants and cannabis. Ecstasy-type drugs, however, appeared to be much more popular on cryptomarkets than out on the street, as it only constitutes about 2 per cent of the total European retail value. On the other hand, estimates suggested that heroin takes up around 28 per cent of the total European drugs retail market, whereas our results suggest that the market share of non-prescription opioids (mostly heroin) remains fairly small (6 per cent). In sum, for online markets there is a predominance of drugs typically associated with recreational or ‘party’ use (cannabis, ecstasy, psychedelics).
xxv RAND Europe Internet-facilitated drugs trade
A possible explanation for these differences between ‘online’ and ‘offline’ markets may be that cryptomarket purchases typically require an element of planning, which may not suit the daily use of dependent users of, for instance, heroin.
How does this compare to the early days of cryptomarkets?
Cryptomarkets have grown substantially in the past few years, but not explosively (Section 4.8) Drugs trade via cryptomarkets has shown to be resilient to law enforcement intervention and distortion, as new market places quickly emerged and gained market share. Since the heyday of Silk Road 1.0 in 2013, however, we conclude that the evolution of drugs trade via cryptomarkets is one of incremental change, rather than explosive. Comparing to results from Silk Road data scraped by members of our team in September 2013, we found that the distribution of drugs types was very similar in 2016. Revenues have about doubled since then, and the total number of transactions has tripled. The number of listings for drugs has grown by 5.5 times.
Still not just an eBay for Drugs (Section 4.5) The lion’s share of transactions on cryptomarkets scraped for this study is generated by listings under $100, most likely to be for personal use. But these retail transactions generate only 18 % of total revenues. We found that large ‘wholesale’ level transactions (those greater than $1,000) remained important for cryptomarkets, generating nearly one quarter of overall revenue both in September 2013 and in January 2016. The often-used analogy ‘an eBay for drugs’ is not entirely correct, because eBay is intended as an online retail market. This is an important finding. Cryptomarket trade may have an impact beyond creating a new way for drug users to access a wide range of drugs; based on the extent of wholesale transactions, we believe it is likely that many cryptomarket customers are drug dealers sourcing stock intended for offline distribution. Cryptomarkets may therefore be diffusing a wide range of substances into local offline drug markets. For clear net markets, there are some indications based on previous studies that NPS are purchased in wholesale quantities online for the purpose of retail or social supply.
Since the early days of Silk Road 1.0, we have observed a number of trends on cryptomarkets (Section 3.2) Trust between vendors, buyers and administrators has been considered important for the success of cryptomarkets and their vendors. However, following a series of security failures, scams and law enforcement disruptions and interventions, observers reported declining levels of trust between actors. These may have impacted on the longevity of individual cryptomarkets. Nevertheless, the environment of reduced trust did not appear to have prevented the drugs trade on online marketplaces, and new innovations and developments appeared to have arisen, allowing trade to flourish in spite of these challenges. Some technical innovations implemented on cryptomarkets are aimed at reducing the risks to vendors and buyers of scams. For example, although not yet widely adopted, multi-signature escrow requires sign-off from two out of three parties, which makes it impossible for one party to single-handedly retrieve funds and disappear. Decentralised markets that operate using a peer-to-peer system, while still in their infancy, have the potential to reduce the possibilities of law enforcement disruption and intervention, as it will be
xxvi Internet-facilitated drugs trade RAND Europe impossible to take the entire system down. Finally, exit scam risk and fear of law enforcement take down have led some vendors to establish single-vendor shops and to encourage potential buyers to approach them via (encrypted) email or direct messaging.
Shipping routes and the role of the Netherlands
Most revenues are generated by vendors who indicate they are operating from Anglo-Saxon countries or Western Europe (Section 5.1) We undertook analysis to understand shipping routes via cryptomarkets and the role of the Netherlands in particular. Cryptomarket vendors appeared to be shipping from dozens of countries. For this study we use vendors who self-report that they are shipping from the Netherlands as a proxy for ‘Dutch vendors’. This could be an underestimate, as there are indications that some ‘Dutch vendors’ also offer listings that ship from outside the Netherlands. In this case, vendors would drive across a border to ship from neighbouring countries like Germany. To our knowledge, and that of the literature, cryptomarkets have primarily manifested themselves in the Anglo-Saxon world and Western Europe. Most vendors appeared to be operating from the United States (890), followed by the United Kingdom (338), and Germany (225). But given their role in production, Asian countries (such as China and India) may also be fertile breeding ground for online drug sales. Vendors indicating they ship from the United States generate 36 per cent of all drug revenues within our sample. Compared to findings in 2013, the distribution of revenues across countries has not changed much with the exception of Australia, which has seen its share of revenues increase over the past three years. Other Anglo-Saxon (Canada and the United Kingdom) as well as Western European countries (the Netherlands, Germany, Spain, France) also generate substantial proportions of revenues. When comparing per vendor, Australia appeared to generate most revenues per vendor. This is in line with the vastly higher prices of drugs in Australia, which probably translates to higher prices per unit.
Revenues from vendors operating from the Netherlands are by far the largest on a per capita basis (Section 4.4) Revenues to vendors reporting to operate from the Netherlands accounted for 8 per cent of total drug revenues from the eight markets monitored. On a per capita basis, revenues to vendors operating from the Netherlands were 2.4 times higher than those from the United Kingdom and 4.5 higher than those from the United States. This perhaps is not surprising given its important role in production and transit of drugs in Europe. Vendors likely to be based in the Netherlands showed clear patterns of specialisation in our analysis, with three quarters of all revenue generated in two drug categories: ecstasy-type drugs (accounting for nearly half of all revenue for these vendors) and stimulants (another quarter). It likely reflects the Netherlands’ role in the production of these drug types, making vendor access to these substances relatively easy and also profitable given their location in the supply chain. Substances, such as MDMA, can be produced inexpensively domestically and then resold for higher prices in other countries. At the wholesale level, this specialisation became even greater, with ecstasy-type and stimulants accounting for 82 per cent of all wholesale revenue for ‘Dutch vendors’.
xxvii RAND Europe Internet-facilitated drugs trade
‘Dutch vendors’ hardly play a role in Cannabis sales (Section 4.4) Contrary to observations made by various interviewees our results suggested that the share of ‘Dutch vendors’ in cannabis sales within the eight cryptomarkets is smaller than might be expected, given the prominent role of the Netherlands in herbal cannabis production and the transit of cannabis resin. We found that only 10 per cent of drugs revenues for ‘Dutch vendors’ was generated by cannabis and ‘Dutch vendors’ shift about 11 kilos a month, just 2 per cent of the total volume of cannabis we identified on cryptomarkets.
The most common shipping routes for drugs are intra-continental (Section 5.2) We found that the United States and Oceania (Australia and New Zealand) were the two most common destinations for vendors who specified where they are willing to ship to. Europe came in third position with about $800,000 in drug revenues. However, it should be noted that it was challenging in this study to trace shipping routes, since more than half of all drug revenues have an unknown destination. The most common routes for drugs were those within United States, within Europe and within Oceania. Here again, given that incomplete or unknown routes account for more than a third of all drug revenues, it was difficult to precisely estimate the share of drug shipping routes.
There is little evidence on the proportion of drugs consumed that are purchased online (Section 5.2) We could find little evidence from previous research and from the new data collected for this study of the demand side for Internet-purchased drugs in the Netherlands. Scraped cryptomarket data only contained information about the destinations that vendors are willing to ship to. There was no information about buyer locations. Almost no listings were posted by ‘Dutch vendors’ that targeted only customers in the Netherlands. Intelligence from law enforcement seems to confirm that ‘Dutch vendors’ primarily sold to buyers abroad, while Dutch buyers predominantly purchased drugs domestically. The limited number of studies that reported on consumers buying drugs online found little to no evidence that Dutch customers were using the Internet to buy drugs.
Products and services that can be used to support drug productions, supply or use are available, but revenues are comparatively low (Section 4.7) Products and services that might be used to support drug production, supply and use, such as counterfeit IDs, financial products and services, or production equipment are also listed on cryptomarkets. They generate sales, albeit in negligible amounts in comparison to drugs themselves. We found that the total revenue generated by these products and services in January 2016 was about 0.2 per cent of the amount generated by drug sales. Only about one in three vendors included in our sample sold non-drug products and services, and these vendors did not tend to also sell drugs. Dutch vendors are nearly absent in this business.
Actors and their modus operandi
The main actors are administrators, moderators, developers, vendors and buyers (Section 6.1) In addition to estimating the size of cryptomarkets, this report presents a characterisation of the different actors involved in these markets, to feed into the broader understanding of Internet-facilitated drugs
xxviii Internet-facilitated drugs trade RAND Europe
trade. There are several actors (knowingly or unknowingly) involved in Internet-facilitated drugs trade, with key actors on cryptomarkets ranging from administrators (executive management and treasurer), developers (web design and maintenance) and moderators (staff members on the marketplace) to vendors and buyers selling and purchasing on these marketplaces respectively. In addition, other actors that play a supporting role (and may not be aware of their involvement) include bitcoin exchangers, Internet Service Providers, suppliers of legal goods and postal services. Vendors and buyers were analysed in more detail, based on literature, interviews and case file data.
Evidence is limited, but vendors seemed to be young, males from English speaking or Western European countries (Section 6.2) Based on limited, sometimes anecdotal, evidence from the literature, interviews and case file analysis, it was found that vendors selling drugs on cryptomarkets seemed to be relatively young (under the age of 40), well-educated and entrepreneurial males from Anglo-Saxon countries or Western Europe with strong IT-skills. Although English was the dominant language on cryptomarkets, some vendors did communicate in other languages. Vendors seemed to be a mix of professional drug dealers with close ties to production who consider Internet sales as an additional revenue stream and ‘newbies’ who thus far only sold drugs to friends. Financial, libertarian and (perceptions of increased) safety motives underpin the decision to sell drugs online. There were no studies identified that provided information on the characteristics of vendors involved in clear net drugs trade.
Buyers are attracted to cryptomarkets because of perceived increased safety, improved quality and variety, ease and speed of delivery (Section 6.3) Similarly, evidence on the consumer side of Internet-facilitated drugs trade is limited. According to previous research and interviewees, buyers on cryptomarkets also seemed to be relatively young, educated and tech-savvy males from Anglo-Saxon and (other) European countries. The majority seemed to consist of recreational drug users (some considered themselves ‘psychonauts’), who have used drugs previously. Buyers seemed to be motivated to buy drugs online due to a perception of increased safety vis-à-vis offline purchases, and improved quality and product variety, anonymity and the ease and speed of delivery. Previous research found that buyers also appreciated the transparency and comprehensiveness of information on products available on cryptomarkets. They tended to base their purchases on price, available ‘trip reports’, products details, vendor reputation and feedback from other buyers. There is currently insufficient evidence to draw firm conclusions on whether the presence of online drug markets leads to new actors that previously would not have sold or bought drugs offline, or whether the offline market is substituted by online markets.
Modes of detection and intervention
There are four broad categories of modes of detection and intervention (Chapter 7) Law enforcement is one of three pillars of Dutch drugs policy, alongside prevention and harm reduction. Anecdotal evidence from the literature and interviews suggests that law enforcement activities have had an impact on confidence in cryptomarkets, but on aggregate, the size of trade has grown nonetheless. Previous studies concluded that the main consequence of bringing down marketplaces has been the
xxix RAND Europe Internet-facilitated drugs trade migration of vendors and customers to other existing cryptomarkets. It has been suggested that the negative impact of scams on trust within markets might be greater than what law enforcement action could achieve. Also, some authors and interviewees highlighted the potential benefits of Internet- facilitated drugs trade to reducing harms associated with drug markets. Based on interview and literature data, we identified four broad categories of potential strategies that are available to law enforcement in the detection and intervention of Internet-facilitated drugs trade: 1. Traditional investigation techniques applied in the drug chain (e.g. surveillance, undercover operations); 2. Postal detection and interception (e.g. collaboration between law enforcement agencies and postal services); 3. Online detection (e.g. big data techniques, monitoring of online marketplaces, tracking money flows); and 4. Online disruption (e.g. taking down online marketplaces). International cooperation and coordination (and the accompanying legal challenges), capacity and resources, and (technical) capabilities could play a facilitating role in deploying the different strategies to tackle Internet-facilitated drugs trade.
xxx
Acknowledgements
The authors are grateful to a large number of individuals and organisations who contributed to this study by providing information, donated their time to be interviewed, provided steer or advice and/or commented on draft versions of this report. We would like to acknowledge some of them in no particular order. We are thankful to the members of the scientific steering committee assembled by the WODC, who offered their expertise, provided feedback on the methodology and research design and commented on the drafts. The steering committee consisted of: Prof dr Dirk Korf (chair, University of Amsterdam), Dr Arno Knobbe (Leiden University and Leiden Institute of Advanced Computer Science), Bas Doorn, Msc, (Netherlands Public Prosecution Service, Openbaar Ministerie), Lodewijk van Zwieten, LLM (Netherlands Public Prosecution Service, Openbaar Ministerie), Vincent van Beest, MA (Ministry of Security and Justice) and Olivier Hendriks (project manager, WODC). A large number of individuals contributed to the study by participating in expert interviews, interviews with law enforcement representatives, participating in a focus group or by providing written input by means of email correspondence. Those individuals who consented to being acknowledged are listed in Appendix E. Some preferred to be listed anonymously. We thank our peer reviewers as part of RAND’s quality assurance process, Dr Priscillia Hunt (RAND Corporation) and Dr Emma Disley (RAND Europe) for their helpful comments on draft versions of this report. Maurice Luxembourg (Nationale Politie) offered indispensable support in setting up the focus group and reviewed draft versions of the report and Bas Doorn has been instrumental in providing access to the case files. We are also grateful to our RAND colleagues Lilly Ablon, Erik Silfversten and Ryan Nathan for their helpful advice and suggestions. We acknowledge the contributions of Katharina Brecht for copy editing the manuscript. The research team has also benefited from the excellent research assistance of Matteo Barberi. Finally, we are grateful to Dr Nicolas Christin for offering his expertise and reviewing the approach and results of the cryptomarket data analysis.
xxxi
Glossary
Term Explanation/definition
Administrator The administrator sits ‘at the top of the cryptomarket hierarchy‘ and within this role has ‘full access to the cryptomarket’ (Martin 2014a, 18). The administrator has an executive and managing role on the marketplace, is responsible for the policies on the marketplace and ‘fulfils the role of treasurer with regard to cryptocurrency’ (Martin 2014a; Van Slobbe 2016, 79).
Buyer Customers on cryptomarkets buy goods on vendors’ seller pages, could provide feedback on these purchases and may be involved in discussions on forums (Martin 2014a).
Bitcoin The most well-known and popular crypto-currency or virtual currency, used on cryptomarkets to make purchases. On Silk Road, only Bitcoin was supported as a payment currency. Bitcoins are not issued by any government, bank or organisation, and can be purchased in person or through online exchanges such as CoinBase.
Crypto-currency ‘A peer-to-peer, client-based, completely distributed currency that does not depend on centralised issuing bodies (a ‘sovereign’) to operate. The value is created by users, and the operation is distributed using an open source client that can be installed on any computer or mobile device’ (Guadamuz & Marsden 2015) As a virtual asset, rather than traditional printed units of fiat money, cryptocurrency cannot be destroyed or lost completely and new units are impossible to create.
Crypto-exchangers Crypto-currencies can be purchased through online exchanges such as CoinBase.
Clear net (or clear The open part of the Internet that is indexed by search engines. web or surface web)
Clear net market or Business-to-customer shopfronts on the surface web or open Internet with typically one web shop vendor only. Clear net markets tend to sell primarily legal drugs.
Cryptomarket Online marketplace on the hidden part of the web that has been intentionally hidden and is inaccessible through standard web browsers. It sells illegal drugs and other goods and services and customers can search and compare products and prices across multiple vendors (EMCDDA, 2015a).
Customer feedback When making a purchase, customers are strongly encouraged to leave feedback. This feedback is posted underneath each listing and usually includes a date, a message (e.g. ‘great product, fast delivery, would repeat business’) and a score. Customer feedback as a proxy for transactions will always result in an extent of under-estimation of actual transactions (Aldridge & Décary-Hétu 2014; 2016a; Christin 2013; Soska & Christin 2015; , Décary-Hétu et al., forthcoming).
Dark net (or dark web The hidden part of the Internet that is not indexed by search engines (Aldridge & Décary- or hidden web) Hétu 2014; Martin 2014a).
Dread Pirate Roberts Pseudonym of Ross Ulbricht, creator and administrator of Silk Road 1.0 He was convicted
xxxiii RAND Europe Internet-facilitated drugs trade
of money laundering, computer hacking and conspiracy to traffic narcotics in February 2015.
Deep web Part of the Internet not accessible through traditional search engines (EMCDDA 2015a).
Developer Developers in the context of this report are primarily responsible for designing the technical infrastructure on online drug markets.
Drugs In this report we refer to drugs as the umbrella term of illicit drugs (such as heroin, cocaine, cannabis, amphetamine, methamphetamine and ecstasy), stimulants and synthetic drugs (NPS), excluding substances such as tobacco, prescription drugs and alcohol.
Encryption The process of taking data that is readable and making it unreadable by using algorithms to create complex codes out of simple data to block access to information (Cyber Experts Blog at National Cybersecurity Institute 2015).
Exit scam Scam whereby the site’s administrators suddenly take the market offline and steal users’ money kept in their escrow accounts (Woolf 2015).
Finalise early A circumvent escrow that ensures direct payment without funds first being held in escrow as a backup measure in times of high concerns for exit scams or law enforcement seizure, reducing the risk that vendors and buyers lose the funds held in escrow.
Escrow An arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorised third party may gain access to those keys. Payment is only released to the vendor when the buyer finalised the sale by indicating that the product had been delivered.
Internet Service Organisation that provides services for accessing and using the Internet. Provider (ISP)
Marketplace In the context of this study we refer to online marketplaces, which bring together multiple sellers in one location.
Moderator The moderator ‘are ranked below administrators in the cryptomarket hierarchy and assist with lower-level site maintenance and customer support’ (Martin 2014a, 18)1. As such, the moderator has less access to the infrastructure of the marketplace and user information than the administrator (Martin 2014a; Van Slobbe 2016). Moderators could receive a salary from the administrators (Martin 2014a).
Multisignature escrow A cryptographic tool that allows buyers to put bitcoins in an escrow account that requires sign-off from two out of three parties – the buyer, the seller, and the website itself – to retrieve the funds. (Mounteney, Griffinths et al. 2016).
New (or Novel) “Substances of abuse, either in a pure form or a preparation, that are not controlled by Psychoactive the 1961 Single Convention on Narcotic Drugs or the 1971 Convention on Psychotropic Substances (NPS) Substances, but which may pose a public health threat” (UNODC 2015 ). They have been designed to mimic established illicit drugs (Druginfo 2015), and are also called ‘legal highs’ as some may not be deemed illegal (yet).
.onion domain Suffix indicating a hidden domain that can be accessed via the Tor network.
Online pharmacies ‘A cybermarket for illegal distribution of drugs that are either unapproved by regulatory authorities, dispensed without a valid prescription, illegal versions of prescription drugs (some ineffective, out of date or contaminated), marketed with fraudulent health claims, or
1 Responsibilities include: ‘regulating forum discussions; identifying fraudulent activity committed by scammers and responding to requests for assistance and complaints from vendors and consumers’ (Martin 2014a, p. 18).
xxxiv Internet-facilitated drugs trade RAND Europe
intended for recreational or criminal use.’ (Maxwell & Webb 2008) The Internet has also facilitated the sales of prescription drugs in recent years (Scammel & Bo 2016).
Operation Onymous Operation Onymous was an internationally coordinated police operation led by the FBI in the United States and involving authorities in 21 countries (Europol 2015). On 5 November 2014, the FBI, together with the U.S. Drug Enforcement Administration, Homeland Security Investigations, and European law enforcement agencies acting through Europol and Eurojust, shut down multiple marketplaces including Silk Road 2.0.
Opioids ‘Opioids are medications that relieve pain. They reduce the intensity of pain signals reaching the brain and affect those brain areas controlling emotions, which diminishes the effects of a painful stimulus’ (National Institute on Drug Abuse 2014a).
Peer-to-peer A system or network that does not have a central server but is distributed between participants (Greenberg 2016; Lewman 2016)
PGP Key Pretty Good Privacy is a data encryption that provides end-to-end cryptographic privacy and authentication that vendors use to encrypt their communications, whereby each individual has a unique PGP key (Cox 2016b).
Reddit ‘Reddit is a website for online content ranging from news and entertainment to social networking where registered members can enter and share content’ (Finklea 2015, 4).
Silk Road (or Silk The first large anonymous online cryptomarket located on the dark net. It was founded in Road 1.0 or SR1) 2011 and was shut down by the FBI in 2013 (Aldridge & Décary-Hétu 2014; BBC 2013; Martin 2014). Several weeks after the taking down of Silk Road, Silk Road 2.0 was launched, which is why the former is also referred to as Silk Road 1.0 or SR1.
Single-vendor shop A cryptomarket that is run by one vendor, which allows vendors to deal directly with their customers avoiding the risks associated with third party escrow or the need to pay a commission to the cryptomarket administrators.
Stealth listings Vendors can create listings that are not available for public view, referred to as ‘stealth’ listings. Vendors send links to these listings privately, but transactions are still processed via the marketplace with escrow facilities remaining available to protect buyers (Aldridge & Décary-Hétu 2014).
Stimulants ‘The use of stimulants increases alertness, attention and energy, and elevate blood pressure, heart rate and respiration’ (National Institute on Drug Abuse 2014b).
Tor Anonymising software that uses encryption to make it difficult for anyone to trace IP addresses (i.e. codes assigned to each computer on the internet) (Barratt 2012, 683).
Vendor A vendor sells his or her (illegal) goods to customers through his or her own seller page (Martin 2014a).
Web crawler Software that methodologically archives websites and extracts information from them. To do so, it starts at a fixed webpage (usually the homepage), downloads that page and parses it for hyperlinks to other pages hosted on the same website. It then follows each hyperlink, adding new hyperlinks it discovers to its list of pages to visit until no new pages are found.
Web scraper A computer software technique to extract information from downloaded web pages identified by a web crawler.
xxxv
1. Introduction
In its two latest European Drug Reports, 2015 and 2016, the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA 2015; 2016a), highlighted the rising importance of the role of the Internet in drug markets. Out on the streets, dealers and runners in retail markets for drugs serve a local customer base, who they typically meet face-to-face (May & Hough 2004). Despite the risks of scams or technology failures, the Internet has brought benefits to consumers and vendors. As in many other markets, such as travel, insurance or personal electronics, the Internet has improved transparency and choice for consumers and facilitated ways for drugs businesses to access potential customers and suppliers. Also, it has enhanced the efficiency and security of off-line criminal activities (EMCDDA 2016b). The role of the Internet in facilitating drugs trade has gained considerable attention since a publication in Gawker on ‘Silk Road’ (Chen 2011), the first large anonymous online marketplace located on the ‘dark net’, the hidden part of the Internet that is not indexed by search engines (Aldridge & Décary-Hétu 2014; Martin 2014a). These online marketplace platforms, called cryptomarkets, bring together multiple vendors listing mostly illegal goods and services for sale. Silk Road had emerged in 2011 and was shut down by the FBI in October 2013. Its administrator, operating under pseudonym Dread Pirate Roberts, was arrested and money that was held in deposit by the site were confiscated (BBC 2013). Soon after Silk Road was taken down, various similar marketplaces or copy cats emerged, among which a new version of the original Silk Road: Silk Road 2.0 (SR2). In November 2014, Europol (2014) announced the closing down of multiple dark websites including SR2. Not much later, several arrests were made in the Netherlands after taking down the online market places Black Market Reloaded and Utopia (Openbaar Ministerie 2015). It is not just the obscure corners of the Internet where drugs are being traded. The EMCDDA (2015a) detected 651 web shops on the surface web (or clear net, containing those web sites that are indexed by search engines) in 2013 with unregulated substances on offer, mostly so-called new psychoactive substances (NPS or ‘legal highs’), which are not regulated, but have a similar pharmacological basis to illegal drugs. As the Internet has had a revolutionary impact on many legitimate industries, the question is whether it has started to transform drug markets as well. While there is no lack of attention for these new trends in markets for illicit drugs, the evidence on their size, shape and evolvement is fairly limited. The extent and nature of this phenomenon and its impact is investigated in more detail in this report.
1 RAND Europe Internet-facilitated drugs trade
1.1. Objectives and scope
This report aims to investigate the role of the Internet in facilitating drugs trade. It is commissioned by the Research and Documentation Centre (Wetenschappelijk Onderzoek- en Documentatiecentrum, WODC), the independent research arm of the Ministry of Security and Justice in the Netherlands. Special attention was therefore paid to the role of Dutch actors in facilitating this trade. The Netherlands appears to play an important role in international drug markets. It is the largest producer of ecstasy and herbal cannabis in Europe and a hub for the distribution of cannabis resin and cocaine (EMCDDA 2016a). Whether that role is replicated in the online world was analysed in this report. The overall aims of this study were: • To characterise the scope and the size of Internet-facilitated drugs trade; • To identify the role of the Netherlands in Internet-facilitated drugs trade; and • To delineate potential avenues for law enforcement for detection and intervention.
When referring to the total scale and scope of Internet-facilitated drugs trade, this study considers trade via cryptomarkets as well as trade facilitated by the clear net. For reasons explained in Chapter 4, the emphasis of this report will be on cryptomarkets, especially the quantitative parts. Chapter 3 will also explain that previous studies have shown that cryptomarkets cover the vast majority of illicit drugs trade facilitated by the Internet, while clear net markets are dominated by new psychoactive substances (NPS).
1.2. Research questions
The Terms of Reference for this study specified a number of research questions. The research team amended these, based on the available sources and proposed methodologies. Consequently, the study focused on answering 22 research questions. These questions are divided into five clusters, looking at: A. Merchandise: the volumes and types of drugs and other goods and services traded; B. Cryptomarkets and other Internet-based market places: their numbers, workings and relevant trends; C. Shipping routes of drugs, including the role of the Netherlands; D. Actors involved in Internet-facilitated drugs trade and their modus operandi; and E. Avenues for detection and intervention.
The table below lists these research questions and indicates the section in which their results are discussed.
2 Internet-facilitated drugs trade RAND Europe
Table 1.1. Research questions
# Research questions Section A. Merchandise
1 Which types of drugs are being traded over the Internet? And how does the size of trade of 4.3 and different types of drugs relate to one another? 4.4 2 In which volumes are the drugs offered? To what extent do these volumes refer towards 4.5 and wholesale or retail? 4.6 3 To what extent are goods and services offered in support of other activities in the drugs 4.7.1. supply chain? 4 To what extent are the drugs offered in combination with other (legal or illegal) goods or 4.7.2 services? If so, which ones? B. Cryptomarkets and other Internet-based marketplaces
5 How many cryptomarkets and other Internet-based marketplaces exist where drugs are 4.2 traded? How do these relate to each other in terms of listings? 6 To what extent do cryptomarkets and other Internet-based marketplaces put restrictions on the 3.4.1 drugs trade? 7 Which trends can we observe in the field of cryptomarkets and other Internet-based 3.2 marketplaces where drugs are being traded? 8 What are the possible trends that occur in terms of the number of vendors involved in drugs 4.8 trade on the Internet and their listings? C. Shipping routes
9 From which countries do vendors operate primarily? 5.1 10 To which countries are vendors willing to ship? 5.2 11 Are there indications that the Netherlands is an important country of origin for drugs trade 5.1 and on the Internet? 4.3 – 4.7 D. Actors involved in Internet-facilitated drugs trade and their modus operandi
12 Which actors are involved in the trade of drugs on the Internet? 6 13 What is known about the developers and administrators of such marketplaces and websites? 6 14 What can be said about the characteristics of these vendors? 6.2 15 How does the payment of Internet-based drugs trade proceed? 3.1.2 16 What is the modus operandi in the shipping of drugs? 3.1.5 17 What can be said about (the development of) the size of the population of customers/buyers 5.2.2 in the Netherlands? 18 What can be said about the characteristics (age, criminal antecedents) of the 6.3 customers/buyers? Which trends are occurring? 19 What is the modus operandi in the buying and receiving of drugs? 6.3.3 E. Avenues for detection and intervention
20 Which broad strategies are available to law enforcement in the detection and intervention of 7.2 the Internet-facilitated drugs trade? 21 Which barriers do law enforcers face in the Netherlands in detection and prosecution of 7.2 drugs trade on the Internet? 22 What were the consequences of bringing down marketplaces? To what extent did any 7.2.4 substitution effects occur?
3 RAND Europe Internet-facilitated drugs trade
1.3. Structure of this report
The next chapter provides an elaborate description of the methods used in this study and explains their limitations. Chapter 3 offers a primer on Internet-facilitated drugs trade. It explains many of the terms used and concepts analysed in the report, and introduces how these markets work. For those unfamiliar with those concepts, it may be helpful to review Chapter 3 first, because it defines much of the terminology used in Chapter 2. The chapter ends with a qualitative description of some important trends in this field. This remainder of the report is structured along the lines of the research questions. Chapter 4 reports on the results of the study’s assessment of the size and scope of Internet-facilitated drugs trade, offering insights from our empirical data collection, and from interviews and the literature. Chapter 5 looks into shipping routes of drugs traded via the Internet, and discusses the role of the Netherlands in particular. Chapter 6 reports on the characteristics and modus operandi of actors involved in Internet- facilitated drugs trade. Based on these findings and mainly insights from interviews, Chapter 7 summarises four main avenues of detection and intervention by law enforcement. Finally, Chapter 8 provides some overarching conclusions and answers each of the research questions listed above.
4
2. Methodology
In order to address the research questions as defined for this study, a mix-of quantitative and qualitative methods was applied, consisting of: a review of the literature; in-depth interviews with experts and law enforcement representatives; collection and analysis of cryptomarket data; and a review of police case files. These methods are discussed in more detail below and additional information on the literature search protocol is included in Appendix B. The emphasis of this study was on drugs trade via cryptomarkets. Previous studies have shown that cryptomarkets are dominated by illicit substances (e.g. Aldridge & Décary-Hétu 2014; Soska & Christin 2013), while clear net market places concentrate on new psychoactive substances (NPS). While developments in the availability and consumption of NPS have been highlighted as important trends (e.g. EMCDDA and Europol 2015; 2016), the emphasis of this study has been on trade of illicit substances via cryptomarkets. The quantitative assessment of the size and scope of this phenomenon conducted as part of this study was carried out through a method designed and developed by some of the report authors, involving the collection and analysis of scraped cryptomarket data (see Section 2.3 for an explanation of this method). Trade of NPS via clear net market places was primarily covered by literature review (see Section 2.1) and interviews (see Section 2.2). Table 2.1 provides an overview of the methods used to address the five clusters of questions identified in Chapter 1.
5 RAND Europe Internet-facilitated drugs trade
Table 2.1. Overview of study scope and methodologies
Cryptomarkets Clear net markets Clusters (focus on illicit drugs) (focus on NPS) Analysis of scraped data Literature review Literature review A. Merchandise Interviews Interviews Case files Analysis of scraped data B. Cryptomarkets and Literature review other Internet-based Literature review Interviews market places Interviews Literature review C. Shipping routes Analysis of scraped data Interviews Literature review D. Actors and modus Literature review Interviews operandi Interviews Case files
E. Avenues for detection Interviews and intervention Literature review
Reading the methodological descriptions provided in this chapter may require some familiarity with the concepts and workings of cryptomarkets e.g (vendors, customer feedback, escrow, finalise early, etc.) and other online market places. Chapter 3 contains a detailed introduction to cryptomarkets and clear net markets for drugs for those not familiar with this field.
2.1. Literature review
The aim of the literature review was to identify, analyse and synthesise scientific and grey literature2 about specific elements of Internet-facilitated drugs trade (both on the clear and dark net) and the options to detect and intervene in these practices. This review particularly focused on complementing aspects of the study’s scope that could not be covered in the analysis of scraped cryptomarket data, such as vendor and buyer characteristics and data on Internet-facilitated drugs trade on the clear net. The review did not aim to capture and analyse all literature or other sources available on the topic of Internet-facilitated drugs trade and should therefore not be understood as a comprehensive bibliography on the topic. For transparency and for further reference, all identified documents are listed in a bibliography in Appendix D. A sub-set of these documents were subsequently analysed. The process followed the following steps, which are a common approach to conducting literature reviews: 1. Protocol development 2. Identifying relevant literature 3. Study selection
2 Grey literature refers to those publications that are produced on all levels of government, academics, business and industry in print and electronic formats, but which is not controlled by (peer-reviewed) academic journals.
6 Internet-facilitated drugs trade RAND Europe
4. Data extraction 5. Quality assessment, synthesising and interpreting the evidence
A detailed description of the search strategy and consulted websites can be found in Box 2.1 on the next page and Table B1 in Appendix B.
7 RAND Europe Internet-facilitated drugs trade
Box 2.1. Steps for conducting the literature review
Step 1. Protocol development
• Defining inclusion and exclusion criteria for studies: o Inclusion: literature in English and Dutch, academic papers, reports from professional organisations, conference papers, investigative journalism. Exclusion: letters, news items. In terms of topics, information on online pharmacies was excluded. • Determining search terms and search strings (Table B1 in Appendix B) • Identifying sources to be searched o Open-source and subscription-only bibliographic databases (Table B1 in Appendix B for a full list of databases consulted) o Google Scholar o Google o Searches within selected websites (Table B2 in Appendix B for a full list of websites consulted) o In addition to the online searches, the study included literature written or indicated by research team members or provided by interviewees o Furthermore, a snowballing approach was applied to references of the sources the project team considered to be most important in the field of Internet-facilitated drugs trade • The NVivo3 coding frame was developed based on the research questions, allowing the software to mark those sections, paragraphs or phrases that provide insights into specific research questions. Step 2. Identify relevant literature
• Conducting the full search on 3 and 4 January 2016 • Including additional materials as provided by members of the research team or interviewees during later stages of the study • Over 300 articles were identified Step 3. Study selection
• Reviewing study titles • Reviewing abstracts if inclusion/exclusion could not be determined based on title • Just over 100 articles were defined as relevant for inclusion in the current study • Given the resources available for this study, it was decided that a total of 88 relevant (based on their titles and/or abstract) and available articles would be included for detailed analysis in a software package called NVivo.to extract information relevant to the research questions. Some of the excluded articles were still used for reference in particular parts of the study (e.g. the introduction chapter), yet were not analysed in accordance with steps 4 and 5 (this also applied to (additional materials identified by the research team or sent to the research team after the 88 articles were selected). See Appendix D for lists of included and excluded studies. Step 4. Data extraction
• Reviewing and characterising selected papers/reports through using a coding frame in qualitative data analysis software NVivo • The coding frame was developed based on the research questions. Where sections, paragraphs or specific sentences in any of the selected sources provided insights into one or more of the research questions, they were marked in accordance with those research questions. Step 5. Quality assessment, synthesising and interpreting the evidence • Bringing together relevant evidence into a cohesive whole. • When synthesising and interpreting the evidence, aspects contributing to the rigour of these publications were taken into account, for example peer reviewed, or transparency in methods/data used. The relevance in relation to the research questions was also taken into account.
3 NVivo is a qualitative data analysis (QDA) computer software package, designed for analysing very rich text-based and/or multimedia information.
8 Internet-facilitated drugs trade RAND Europe
2.2. In-depth interviews
In order to further examine the characteristics of Internet-facilitated drugs trade and (possible) practices around detection and intervention, semi-structured interviews with experts in Internet-facilitated drug markets and with law enforcement representatives were conducted. In addition to these one-to-one interviews, a focus group was conducted with Dutch law enforcement representatives, in order to capture views from several stakeholders at once and to facilitate a group discussion around the study topic and to validate study findings to date. The interviews and focus group aimed to capture expert views on and knowledge of the topic in order to supplement the cryptomarket analysis and information gathered through the literature review. Given the international character of Internet-facilitated drugs trade, respondents from the Netherlands as well as other countries were interviewed. Approval from the Dutch police was granted for conducting interviews with Dutch law enforcement representatives.
Selection and recruitment of interviewees The research team used a purposive sampling strategy for selecting the interviewees since there was a good understanding of the type of interviewees relevant for this research.4 Due to its flexible nature, quota sampling – a form of purposive sampling – was used in which minimum quotas per interviewee category (experts and law enforcement representatives) were laid down. This procedure ensured ‘that key groups are represented in the sample, while providing flexibility in the final sample composition’ (Robinson 2014, 34). In addition to the list of potential interviewees that the research team created, the team also received contact details via other sources, for example through members of the Scientific Steering Committee of this study and through interviewees. A contact person at the Dutch police assisted the research team in approaching law enforcement representatives and other experts in March 2016 and subsequently helped the researchers in setting up the logistics for the focus group, which took place in April 2016. Respondents for the individual interviews were contacted between December 2015 and April 2016. In those cases, where the candidate interviewees had not respondent after two reminders, they were considered a non-response. There were a few instances where respondents indicated that based on their organisation’s policy they could not take part in an interview. The table below lists interviewee numbers per category (expert or law enforcement interview) and the modes in which the interviews were conducted (i.e. in-depth interviews, focus group or in writing). A full list of interviewees is provided in Appendix E.
4 As Robinson (2014) summarises it: ‘The rationale for employing a purposive strategy is that the researcher assumes, based on their a-priori theoretical understanding of the topic being studied, that certain categories of individuals may have a unique, different or important perspective on the phenomenon in question and their presence in the sample should be ensured’ (p. 32).
9 RAND Europe Internet-facilitated drugs trade
Table 2.2. List of interviewees
Type of interviewee Type of interview Total
Experts in Internet-facilitated drugs trade In-depth interview 8
Dutch law enforcement representatives (e.g. police, public In-depth interview 6 prosecutor) involved in targeting Internet-facilitated drugs trade
Dutch law enforcement representatives with knowledge of detection, Focus group 6 investigation and prosecution (i.e. police, anti-fraud agency, (forensic) research organisations)
Representatives of European and international agencies involved in In-depth interviews and in 6 targeting Internet-facilitated drugs trade writing
Total number of interviewees consulted 26
Conducting the interviews In advance and reiterated at the start of the interview, respondents were provided with an information sheet (included in the invitation email) that provided details of the study, confirmed that interviewees’ participation was voluntary, set out about how information provided would be attributed and asked interviewees’ consent for audio-recording of the interview. For the in-depth interviews, respondents were informed that the information they provided would not be attributed to named individuals and were asked if information could be attributed to them using general roles or types of organisation instead (for example ‘law enforcement expert’ or ‘expert’). The focus group was held under the Chatham House Rule in which findings were not attributed to individual members of the focus group. The majority of the expert and law enforcement interviews were conducted in a one-to-one setting (with a few interviews in which two respondents took part), either by phone or face-to-face, and the interviews were recorded for note-taking purposes after consent of the interviewees. A topic guide was prepared in advance of the interviews, covering the main research questions. The topic guide used for the in-depth interviews is included in Appendix F, and key focus group questions are listed in Box 2.2 below. The topic guide and focus group questions followed a semi-structured approach that left room for elaboration or additional questions to be raised and discussed.
Box 2.2. Key focus group questions
How does Internet-facilitated drugs trade relate to the global (offline) drugs trade? What will be the trend in the long term?
The what extent has Internet-facilitated drugs trade taken over a part of the street trading / or has it tapped into a new market of users who previously did not (or hardly) bought drugs?
What are the priorities in tackling Internet-facilitated drugs trade?
What are possible targets for detection and intervention of Internet-facilitated drugs trade? What are the possibilities for detection and intervention during the different parts of the supply chain (production excluded)?
What are the advantages and disadvantages of these targets, and what obstacles must be overcome?
10 Internet-facilitated drugs trade RAND Europe
Although the research team raised these questions during the interviews and the focus group, the extent to which they were answered depended on the information provided by interviewees. For example, as appropriate given the topic, law enforcement representatives and experts could not answer certain questions that would require discussion of sensitive information relating to ongoing investigations or law enforcement methods, sources and approaches. This particularly limited the extent to which this study could answer the research questions regarding avenues for intervention and detection. When information from the interviews was unclear or when it was not clear if information could be brought in the public domain, the research team followed–up with relevant interviewees for clarification and/or verification. Via email, interviewees were also asked to confirm if and how they preferred to be mentioned in the list of interviewees, and were provided with an example on how interviewee data would be used in the report. All interviewees agreed with how their data would be used for this report. In addition, a representative of the Dutch police reviewed this report in advance of its publication to ensure that no sensitive information on detection and intervention practices was included.
Analysis and reporting of interview data Detailed interview notes were taken during the interview and analysed by members of the research team using an approach in which different themes relevant to the research questions were identified and clustered. The analysis looked for areas of agreement and disagreement both between and within different categories of interviewees (experts or law enforcement representatives). Interview data were then incorporated throughout the report where they complemented or contested findings from the cryptomarket analysis or literature review. Interviewee codes are used in the report to indicate the type of interviewee (‘EX’ for ‘expert’ and ‘LE’ for ‘law enforcement expert’). The numbers added to these codes to not reflect the order of interviewees listed in Appendix E. Focus group participants are referred to as one group.
2.3. Quantitative analysis of cryptomarket data
This study collected new, primary data from cryptomarkets, web sites selling licit and illicit products and services on the dark web. This was done through the use of the DATACRYPTO software tool, designed by Décary-Hétu and Aldridge (2013) specifically designed for the purpose of collecting information about online drugs transactions. Table 2.3 presents the eight cryptomarkets monitored for this report, including their date of creation, the number of listings and the number of vendors. These cryptomarkets were selected by the research team based on their size, their focus on specific types of products or their origin; for example, French Dark Net is designed for French users. The way in which the DATACRYPTO tool works means that it cannot be used on some cryptomarkets. For instance, Outlaw, Valhalla, TheRealDeal and Dr. D are markets that were programmed in such a way that the DATACRYPTO tool was unable to stay logged in and collect data. We believe that this is more the result of anomalies in the programming, rather than the use of active crawling countermeasures. The German-Plaza cryptomarket focused mainly on hacking services and stolen financial information and was therefore not crawled.
11 RAND Europe Internet-facilitated drugs trade
Table 2.3. Descriptive statistics of cryptomarkets
Cryptomarket Date of creationa Number of listings Number of vendorsb AlphaBay 2014/12/22 37,896 2,001 Cryptomarket 2014/12/22 8,362 432 Dark Net Heroes League 2015/05/27 387 76 Dreammarket 2013/11/13 22,284 847 French Dark Net Unknown 1,307 331 Hansa 2015/07/18 4,829 219 Nucleus 2014/10/24 26,538 1,013 Python 2015/07/10 4,208 144 Total 105,811 5,063 NOTE: a Information about the date of creation of cryptomarkets was collected from DeepDotWeb (2016a). b Vendors who operated on multiple cryptomarkets were included in the count of vendors for each cryptomarket where they operated. The total number of vendors is therefore not indicative of the unique number of vendors active on cryptomarkets in January 2016.
2.3.1. Data collection method
The data for this report were collected over a period of five days starting on January 11th, 2016 using the DATACRYPTO software tool developed by Décary-Hétu and Aldridge (Décary-Hétu & Aldridge 2013; Aldridge & Décary-Hétu 2015a). DATACRYPTO is a web crawler/scraper class of software that systematically archives websites and extracts information from them. Once a cryptomarket has been identified, DATACRYPTO is set up to log in to the site and download its contents. To do so, it starts at a fixed webpage defined by the researchers (usually the homepage). It first downloads that page and parses it for hyperlinks to other pages hosted on the same website. It then follows each hyperlink, adding new hyperlinks it discovers to its list of pages to visit until no new pages are found. At that point, DATACRYPTO switches from its crawler to scraper mode and starts extracting information from the pages it has downloaded. Each data point is coded by the researchers who teach DATACRYPTO what to look for (for example product titles, prices, product descriptions). DATACRYPTO stores data from all of the websites it crawls and scrapes in a unified database that allows for cross-market queries such as: who are the vendors of cannabis operating from the Netherlands in all cryptomarkets? We note (and discuss further in later sections of this report) that the data that can be collected via crawling and scraping from a drug cryptomarket relates primarily to the supply side: we cannot ascertain location or any other characteristics of buyers. As well as analysis of new data collected for this study, analyses related to trends are based in part on data that were collected on Silk Road 1.0 between September 13th and September 15th 2013 using the same DATACRYPTO tool. The earlier version of DATACRYPTO used by members of the research team to collect these data worked in exactly the same way, but with a reduced level of automation. In both the earlier and current versions of DATACRYPTO, the end result is identical: a list of all listings that were online at one point in time; in this case, on or just after January 11th 2016.
12 Internet-facilitated drugs trade RAND Europe
Using a single crawl to study cryptomarkets may be problematic as a crawler may appear to have crawled an entire cryptomarket when it in fact only indexed a part of it (see Soska & Christin 2015 for a discussion of this issue). This can happen when the Tor network itself is having reliability issues, when the cryptomarket is actively logging out the crawler, requiring it to log back in again or when the cryptomarket itself goes offline. For larger cryptomarkets that take days to crawl, it is also possible for listings to go offline and for new ones to be created during the crawl. Our DATACRYPTO tool was designed to deal with these issues from the start. It is a state-aware software, meaning that the result of each request is analysed and logged by the software. If the Tor network or the cryptomarket was down, it would know to stop and try to continue its crawl a few minutes later. If a request for a page returned a different page (e.g. asking for a listing page and receiving the home page of the cryptomarket), the request is marked as failed and added to the count of failed pages. During the January crawl, all markets had a well below five per cent failed request rate. DATACRYPTO is also able to detect whether it is logged in or logged out of a cryptomarket and to login autonomously if needed. During the January crawl that produced the data used in this report, on the occasions that DATACRYPTO was unable to re-establish the log-in itself, it sends an email to researchers who are able then manually to log back in. For some cryptomarkets, this manual login had to be repeated dozens of time in order to complete the crawl; for other cryptomarkets, this was never necessary. The only issue with the completeness of our crawl is the fact that some larger cryptomarkets like Alphabay have over 500,000 web pages that need to be indexed. This needs to be spread over a period of days, days during which the cryptomarket itself is changing. This issue is offset by the slow churn of listings over a period of five days and the fact that new listings are also indexed by the crawler.
2.3.2. Methods for estimating measures
The ‘big data’ generated by crawling and scraping cryptomarkets cannot be used to generate analysis and understanding uncritically, and therefore must be manually checked, cleaned and recoded before it can be analysed. Furthermore, due to several potential caveats, we make conservative assumptions and provide lower bound estimates on the size and scope. Estimates in this study, therefore, err on the side of not over- estimating or misleading the size and scope of the market. The approach taken to the following issues are explained below:
• how we treat holding process; • how we count the number of transactions; • how we estimate monthly revenues; • how we identify shipping routes; • how we generate product categories; • how we estimate quantities; • our approach to vendor name matching; and • dealing with stealth listings.
13 RAND Europe Internet-facilitated drugs trade
2.3.2.1. Holding prices
One issue we faced is related to prices, and more precisely, to holding prices on listings. Vendors sometimes increase the price of a listing by an order of magnitude when out of stock or otherwise unwilling/unavailable to process transactions. This technique of using holding prices has the advantage for the vendor of keeping a listing active with all of its associated customer feedback, while simultaneously deterring customers from making purchases as a result of the abnormally high price of the listing. Holding prices are problematic when taken as indicative of ‘actual’ market prices, as they will distort estimations of drug prices, revenues and price per unit of drugs.5 To identify listings with possible holding prices, we created a historical database of the prices of listings from previous crawls and scrapes of cryptomarkets that were made in the months prior to the data collected for this report using the same DATACRYPTO tool. Instead of using the most recent price associated with a listing derived from our data collection, we used its median price, thereby excluding occasional high prices collected for any one listing. This historical database contained an average of 4.4 prices for each listing (Min = 1.0; Max = 14.0; S.D. 3.4). A similar technique was used by Soska and Christin (2015) to deal with the potential distorting effect of holding prices. Of course, this technique does not eliminate all holding prices since some newer listings have no historical prices.
2.3.2.2. Number of transactions
A second estimation issue relates to the number of transactions facilitated by cryptomarkets. The size and scope of cryptomarkets is one of the main research questions for this report and to measure it, it is essential to calculate the number of purchases made connected to each listing over a period of time. Unfortunately, cryptomarkets do not post publicly the transactions they facilitate and researchers must use a proxy to estimate transactions. All past research into cryptomarkets (Aldridge & Décary-Hétu 2014; 2016a; Christin 2013; Décary-Hétu et al. forthcoming; Soska & Christin 2015), has used customer feedback as the best and only proxy to estimate transactions. When making a purchase, customers are strongly encouraged to leave feedback. This feedback is posted underneath each listing and usually includes a date, a message (e.g. ‘great product, fast delivery, would repeat business’) and a score.
The percentage of feedbacks received Customer feedback as a proxy for transactions will always result in an under-estimation of actual transactions. Some customers may be unwilling to leave feedback or may forget to do so after a shipment has been received. Information regarding the proportion transactions without feedback is scant. To estimate it, Aldridge and Décary-Hétu (2014) compared the number of feedbacks their DATACRYPTO tool had collected to the number of transactions advertised on the vendors’ profiles on SR1. Their analysis showed that 88 per cent of transactions at the time led to a public feedback. The same method was used by the authors to update the extent of underestimation when data were collected for the present analysis in January 2016. Only one cryptomarket active in 2016 provided a useable vendor transaction metric:
5 Whilst increasing prices as supply falls is a typical economic behaviour, ‘missing prices’ would be typical when firms have no supply. However, vendors in this market cannot take their good off the market and instead provide extreme, obviously unrealistic ‘holding’ prices. We reduce the impact of these extreme prices by using the median.
14 Internet-facilitated drugs trade RAND Europe
DreamMarket. Based on this limited sample (N = 1,129 vendors), 71 per cent of transactions of vendors were captured through feedbacks. Similarly, a law enforcement representative (LE2) stated that their intelligence suggest that 80.6 per cent of transactions lead to public feedback on large cryptomarkets; a figure that is right in between the two DreamMarket estimates. These estimates suggest that the number of feedbacks should be multiplied by between 1.14 and 1.41 to better estimate the true number of transactions. Doing so, however, assumes that the DreamMarket- obtained estimate is representative of all cryptomarkets in connection to the number of missing feedbacks we were able to detect. This is highly unlikely since the design of each cryptomarket varies in terms of how much it is a default and/or explicit for customers to leave feedback. Some cryptomarkets may also send reminders to customers who have failed to leave feedback or may not require that repeat customers leave feedbacks for each purchase of the same listing. Combined, these limitations make any multiplier based on the partial data available to us limited to only one marketplace sufficiently unreliable that we elected to refrain from providing range estimates for transactions. As explained below, however, we do provide an overall upper-boundary estimated for the total monthy revenues (see Section 2.3.2.3).6
The moment of capturing the feedback Another issue relating to the number of transactions relates to the moment of capturing the feedback. Given the growth of cryptomarkets over the past years (Soska & Christin 2015), the number of transactions on cryptomarkets overall has increased steadily. To better estimate the latest trends, this report estimates transactions that occurred during the month before the data collection. Transactions are based therefore on feedbacks with a post date between 11 December 2015 and 10 January 2016. Because feedbacks occur at some point subsequent to the transaction date, these feedbacks will (1) include some purchases made prior to the data collection period; and (2) exclude some purchases made during the data collection period, for which feedback had yet to be posted. Other feedbacks may be unaffected by the delay between purchase, and shipment receipt when customers ‘finalised early’ (that is, paid for goods prior to their receipt). Cryptomarkets do not contain information about transaction date, and although we use feedbacks as a transaction proxy measure, this should be understood as the moment when funds are released from a customer to a vendor in situations when customers leave feedback, and not when a drug was purchased or delivered. We therefore believe that this will not have impacted our estimate of the number of transactions.
The turnover of listings on cryptomarkets The final issue regarding the number of transactions is that of the high turnover of listings on cryptomarkets. Listings only remain online for a few weeks on average and vendor accounts themselves are only online for 220 days on average (Soska & Christin 2016). Since the DATACRYPTO tool only
6 We further investigated to see if the extent to which feedbacks underestimated transactions was related to the price of a listing. We calculated for each vendor the extent of underestimation and correlated this with the average value of the products sold by that vendor. The Pearson correlation was not significant suggesting that the extent of underestimation is not related to price. Similarly, a law enforcement official (LE2) states that their intelligence confirms these findings.
15 RAND Europe Internet-facilitated drugs trade collected the listings during the week of 11 January 2016, it did not collect all of the listings that were active during the feedback sampling period from 11 December 2015 to 10 January 2016. As such, it was unable to count the feedbacks associated to those listings. To compensate for the missing listings, a new methodology was developed in Aldridge and Décary-Hétu (2016a) and used once again in Décary-Hétu et al. (forthcoming). It assumes that during the sampling period, the number of listings was fairly similar to those during the crawl period (the week of January 11th 2016). It also assumes that the missing listings transacted at about the same rate as those that were online during the crawl period. In other words, we assume that the listings that disappeared during the feedback sampling period were replaced by similar listings and that the missing feedbacks can be estimated using the active listings. To do so, we ‘scale up’ the number of feedbacks for the listings that were placed online after the initial date of the feedback sampling period by multiplying their daily rate of transaction by 30. So, for example, if a listing had received five feedbacks in the ten days since it was first posted by the vendor, its number of feedbacks was multiplied by three (to 15) to allow us to make appropriate comparisons across listings with varying lifespans. More research will be needed to evaluate precisely the accuracy of this methodology, but it is at the time of writing, the only approach available in the literature to compensate for missing listings however and should improve the accuracy of the estimates. Therefore, it was used in this study.
2.3.2.3. Monthly revenues
Cryptomarkets do not make publicly available the revenues of their vendors. To estimate monthly revenues, we multiplied the number of feedbacks of each listing by its median price. This provided us with a lower-bound estimate of the revenues generated on cryptomarkets for the month preceding 11 January 2016. Of course, these represent gross revenues and the actual profits from these revenues are unavailable and notoriously difficult to estimate self-employment costs. We note here that across the eight cryptomarkets the majority of all marketplace listings (79 per cent) generated no transactions; 72 per cent of drug listings generated no sales. Listings with at least one transaction were therefore more numerous for drug (28 per cent) than non-drug (11 per cent) listings. Moreover, having at least one transaction associated with a listing was not evenly spread across listing price. For drug listings, this was most common among lower priced listings (36 per cent of listings up to $100) and dropped in a linear fashion for higher priced listings (8 per cent listings priced over $1000). It is important to understand whether the month relevant to our data collection (mid-December to mid- January) is representative of drug purchasing at other times of the year. Research has shown that substance consumption (both alcohol and drugs) varies by month/season (Cho et al. 2001; Del Río; Lai et al. 2013; Prada et al. 2002); use is typically higher during holiday periods, with December often the peak month. To our knowledge, there is no research examining seasonal variation in drug buying. Although we might expect drug use and drug purchasing generally to occur at roughly the same time, drug users may purchase in advance of their use, and we reason that this is particularly likely to be the case for customers making purchases for personal use on cryptomarkets (and even more likely to be the case for cryptomarket customers who are drug dealers sourcing stock for offline distribution). One the one hand, our data collection refers to a period that overlaps with what is typically an increased consumption period for drug users (December) as well as a period typically associated with decreased use (January), suggesting that seasonal differences may be cancelled out. On the other hand, cryptomarket users must make purchases in
16 Internet-facilitated drugs trade RAND Europe advance of their use to take into account processing and delivery times, suggesting that most cryptomarket drug-buying intended to supply seasonally inflated use in the December period will have occurred in November and early December, thus prior to the period to which our data collection refers. This ‘reasoned guesswork’ leads us to suggest that the period to which our data collection refers may include fewer transactions than might have been the case had our data collection referred to October or November. It is therefore consistent with our aim to generate lower bound estimates. When estimating an upper-boundary estimate of the total monthly drugs revenues on cryptomarkets
( ), we use the following formula:
=
whereby is the fraction of total listings on all cryptomarkets scraped. In Section 4.2.1 we explain that the January DATACRYPTO scrape on which our results are based captured about 80 per cent of all listings across all cryptomarkets. It is likely that the revenues per listing on cryptomarkets not scraped by DATACRYPTO are lower than those that are scraped, because revenues per listing tend to correlate with the size of a cryptomarket. This means we assume that the 20 per cent of the listings not covered by the 8 scraped cryptomarkets generate no more than 20 per cent of revenues.
Furthermore, is the lower-boundary estimate, is the fraction of transactions for feedback is provided. We assume that, if buyers leave feedback in only 71 per cent of transactions (c.f. DreamMarket estimate, see Section 2.3.2.2), the total revenues would be a maximum of 41 per cent higher (1/0.71=1.41). Intelligence from a law enforcement representative (LE2) suggests that larger transactions (e.g. over $1,000) are more likely to generate feedback than smaller ones. Therefore, it seems reasonable 1 to assume that the multiplier of (in this case, 1.41) will generate an upper-boundary estimate. This estimate does not include revenues via potential stealth listings (see Section 2.3.2.8), nor does it compensate any potential seasonal effects (see above), as there is no information about these phenomena to draw any meaningful assumptions.
2.3.2.4. Shipping routes
Cryptomarkets provide us with data about countries or regions from which vendors indicated they ship products as well as countries or regions to which they are willing to ship. This information is included on each listing page. Researchers use this information as a proxy for a vendor’s country of operation (e.g. Aldridge & Décary-Hétu 2016a; Christin 2013), but as with using customer feedbacks as a proxy for transactions, this approach has limitations. For example, a vendor from Germany could advertise a listing as ‘shipping from’ the Netherlands. It is impossible to verify the true country of operation for vendors using simply quantitative data collected on cryptomarkets. Bearing these caveats in mind, our country-based analyses used these ‘shipping’ location data. They were cleaned manually. Countries where goods were shipped from and to were aggregated at the region and continent levels using a list published by the UN (UNSTATS 2013).7 When listings indicated products would be shipped worldwide, or to multiple regions that spanned our categorisation scheme, we coded
7 As of 23 June 2016: http://unstats.un.org/unsd/methods/m49/m49regin.htm
17 RAND Europe Internet-facilitated drugs trade these as ‘Worldwide/multiple regions’. Where the origin or destination of listings could not be determined, listings were categorised as Unknown. Note that in the report we use terminology such as ‘Dutch vendors’. For clarity: this actually means only that a vendor stated that the product on a listing would be ‘shipped from’ the Netherlands. We acknowledge that it is possible that ‘Dutch vendors’ as assessed in this way may not reside in or operate from the Netherlands, and indeed that actual ‘Dutch vendors’ may indicate a different ‘ship from’ region. We use this phrasing (consistent with other published research) for ease of expression. The tables we produced involving analysis by country will of necessity involve some double counting. For example, a vendor with one listing that ‘ships from’ the USA and another that ‘ships from’ the UK will be counted twice. For this reason, summing would provide totals that would exceed the number of vendors we estimate to be in the sample. We have therefore excluded totals in the tables. The possibility that vendors can list different ‘ship from’ locations for different products is an illustration of the limitation of using these data as a proxy for vendor location. Although it seems likely that most vendors will accurately list their location (not least to avoid deception and potentially negative feedback from customers arising from this), there may be valid reasons vendors list ‘ship from’ locations that do not coincide with their location. We consider some of these in the report.
2.3.2.5. Product categories
Cryptomarkets allow vendors to categorise their listings using a pre-existing set of categories. The AlphaBay cryptomarket for example offered 99 different product categories including more general ones for Drugs and chemicals and more specific ones for jewellery. Markets typically allow drug vendors to classify the product being listed for sale into drug sub-types (e.g. ‘cannabis’, ‘opiates’, ‘prescription’). In our earlier cryptomarket research, we found that vendors did not classify drugs in a consistent manner (see Aldridge & Décary-Hétu 2016a). Moreover, categorisation schemes across multiple markets differ substantially, and cannot be combined. We therefore created our own categorisation scheme. Drug- related listings were placed into one of eight categories (plus one ‘other’) and the other listings into 10 categories, some of which included drug-related products (e.g. bongs, scales) (see Appendix A). Some 555 listings (0.5 per cent) could not be categorised due to a lack of information. The non-drug-related listings were eclectic, ranging from stolen cars to eBooks on how to date. The coding process was done by 7 coders supervised by the two of the study authors David Décary-Hétu and Judith Aldridge. Coders did not code the same listings but were all asked, at the end of the coding phase, to code a sample of 200 listings selected at random to measure their inter-rater agreement. Based on intra-class correlation using a two-way mixed model, the coders’ inter-rater agreement stands at 99 per cent.
2.3.2.6. Quantities
Cryptomarkets do not list the quantity of products (i.e. drugs, credit cards, etc.) or the advertised purity of drugs in a field that would be possible to extract automatically from the listings in a reliable fashion. Instead, coders manually extracted this information from the title of the listings and in many instances, using additional information from the more detailed textual description contained in the listings. The coding process was done by five coders. Coders did not code the same listings but were all asked, at the end of the coding phase, to code a sample of 200 listings selected at random to measure their inter-rater
18 Internet-facilitated drugs trade RAND Europe agreement. Based on intra-class correlation using a two-way mixed model, their inter-rater agreement stands at 100 per cent for quantity, 98 per cent for number of units and 100 per cent for purity.
2.3.2.7. Vendor name matching
Many vendors placed listings on more than one market (also indicated by EX18). In some cases, vendors may also want to open multiple accounts on the same market, although they may be deterred from doing so due to the costs incurred through the marketplace requirement for vendors to pay a ‘bond’ in creating accounts. To identify the accounts that belong to the same individual or group, we compared the encryption keys8 that vendors used to encrypt their communications. This encryption key is by definition unique, and other researchers have used encryption keys as a way to identify different vendor accounts belonging to the same vendor (Broséus et al. 2016; Soska & Christin 2015). Our initial dataset included 5,083 vendors. Some 4,116 vendor accounts (81 per cent) had an encryption key associated to them either in the vendor description or in a product description, allowing us to match vendors. We found 2,902 unique encryption keys, which, when adding the 967 vendor accounts without an encryption key, reduced our population of vendors to 3,869. We were able to further match 23 vendors based on their use of identical profile descriptions, leaving us with a final dataset that includes 3,846 vendors. Vendors had between one and five accounts (M = 1.32; SD = 0.652). Where vendors created multiple accounts with different vendor names, vendor descriptions and encryption keys, it is impossible for us to match the vendors; our estimate of the number of vendors is therefore an upper estimate of their numbers.
2.3.2.8. Stealth listings
All of our analyses were based on publicly available listings on dark net cryptomarkets (i.e. listings that anyone able to navigate to the cryptomarket would be able to see). It is possible for vendors to create listings that are not available for public view, referred to as ‘stealth’ listings. Vendors send links to these listings privately, but transactions are still processed via the marketplace with escrow facilities remaining available to protect buyers. There is no way of knowing precisely how many non-public listings are available , although analysis of data collected from potentially seized cryptomarket servers may provide some insights. Our count of listings will therefore be an underestimate due to the existence of these hidden listings (Aldridge & Décary-Hétu 2014).
2.4. Case file analysis
In order to complement findings from the literature and interviews, an analysis of Dutch police case files was conducted. The primary aim of the case file analysis was to further illustrate the characteristics (e.g. age, antecedents where possible, etc.), and where possible modus operandi of vendors, administrators, developers, moderators and other actors involved in Internet-facilitated drugs trade.
8 Vendors used Pretty Good Privacy (PGP) encryption keys, which is a standard in the security industry to encrypt messages.
19 RAND Europe Internet-facilitated drugs trade
Following exploratory discussions with representatives from the Dutch Public Prosecution Service (Openbaar Ministerie) one case9, consisting of several files and involving vendors, administrators, developers and moderators, was selected for in-depth analysis. Relevant institutions10 granted approval for access to and analysis of this case. To ensure anonymity of the actors involved in this case, identifiable personal details included in the files such as full name were not recorded nor reported by the research team. Representatives of the Dutch Public Prosecution Service and the Dutch Police reviewed the case file information included in this report in advance of publication to ensure no confidential information or personal identifiers were included. Findings from the case file analysis are not representative of all actors involved in Internet-facilitated drugs trade, and are solely included to provide information supporting, challenging or complementing the findings of the literature review and interviews. Information included in the files was mainly based on observations by law enforcement officials (e.g. summaries of interrogations) and self-reporting by suspects involved (e.g. information provided during interrogations). As such, these findings should be treated with caution. Finally, it was not possible to make firm statements about criminal antecedents (if it was mentioned at all this was self-reported by actors during interrogation) or about where vendors obtained their drugs due to limited availability of (or in some cases absence of) information on these issues in the case files.
9 For confidentiality reasons it was not possible to include additional information on the total number of cases from which the case was selected. It can, however, be noted that the volume of cases was limited. 10 These include: Public Prosecution Service (Openbaar Ministerie), Dutch Police (Nationale Politie) and Council for the Judiciary (Raad voor de Rechtspraak).
20
3. An introduction to Internet-facilitated drugs trade
This chapter offers an introduction to the workings of and terminology used for Internet-facilitated drugs trade, based on the available literature and interviews. This chapter primarily addresses research questions focussed on cryptomarkets and other Internet-based marketplaces (research questions’ clusters B, and partially D, see Table 1.1). Drug markets operating on the clear net appeared to be primarily associated with distribution of either non-controlled substances or substances for which legal controls differ between countries and jurisdictions (EMCDDA 2016b). Trade of illicit substances tends to be concentrated on online market places on the dark web accessible only via anonymising software (such as a Tor browser) that uses encryption to make it difficult for anyone to trace IP addresses. In this chapter we focus primarily on drugs trade via cryptomarkets as well as web shops on the clear net. The description is intended as a general overview and introduction to Internet drugs trade. There are several other resources available that offer a more detailed account of these phenomena.11
3.1. Drugs trade via cryptomarkets
This section discusses the features of cryptomarkets and explains how they work. We use the term ‘cryptomarkets’ (c.f. Aldridge & Décary-Hétu 2014; 2016b; Barratt 2012; Martin 2013;), following early use of this term in hacker forums (Aldridge & Décary-Hétu 2016b), but we note that the term ‘dark net markets’ also becomes more established (e.g. Buxton & Bingham 2015). Cryptomarkets look similar to regular online market places, such as eBay or Amazon, by allowing their customers to search and compare products and rate vendors). Hidden locations on the Internet, accessible only via anonymising software, such as a Tor browser, are home to a number of online marketplaces where the sale of drugs, legal highs, poisons, weapons and stolen data makes it a multi-million dollar industry (Cox 2015b). While there were some subtle differences between cryptomarkets, we have generalised their characteristics and features in this section. One of the features of these cryptomarkets is the ability for users to operate anonymously. Cryptomarkets employ anonymisation services such as ‘Tor’12, which hide a computer’s IP address when accessing the site and obscure its identity. Identification of the person using the Tor or other anonymising software is difficult due to the fact that the architecture and encryption of the Tor network is impervious to most
11 See for example: EMCDDA (2015a; 2016). 12 See: https://www.torproject.org/ , as of 6 November 2015.
21 RAND Europe Internet-facilitated drugs trade kinds of attack or monitoring by law enforcement. Traffic routed through the Tor network can be slow since it makes six hops or relays from the user’s computer to the cryptomarket. These hops are random throughout the worldwide Tor network, making it difficult to discern the nationality or location of either buyer or seller. Cryptomarkets provide drug dealers with a worldwide market for their products and the capacity to sell to customers they do not know, to trade anonymously in a relatively low-risk environment (Aldridge & Décary-Hétu 2014) with increased personal safety and reduced possibility of violence. There are other risks however, such as those associated with technical failure or scams.
3.1.1. Purchase and feedback
Cryptomarket users need to create a free account, after which they are able to browse vendor pages to compare products (Martin 2014a; Van Slobbe 2016) or access the site forums for information about products (Martin 2014a; Van Hout & Bingham 2013b). Figure 3.1 provides a screen shot of an overview of drug listings on AlphaBay, one of the largest cryptomarkets.
Figure 3.1. Screen shot of drug listings on AlphaBay Market
NOTE: As of 27 June 2016. Vendor aliases are removed. Buyers can place an order with an online vendor and receive the drugs by mail package (Lavorgna 2016; Van Slobbe 2016). In order to counter law enforcement efforts, cryptomarket discussion forums and seller Q&A pages advise buyers to use pseudonyms and have purchases delivered to addresses other than their home (Martin 2014b). After receiving their purchase, buyers can leave feedback for the vendor to indicate whether the product and the service met expectations (Van Slobbe 2016). Cryptomarkets such as Silk Road and Agora (a marketplace established in December 2013 and closed in August 2015) featured a feedback system that
22 Internet-facilitated drugs trade RAND Europe allowed buyers to review vendors and their products, similar to business-to-customer e-commerce sites such as Amazon or eBay (Aldridge & Décary-Hétu 2014; Tzanetakis et al. 2016). Indeed, buyers are expected to leave feedback on their experiences with vendors, so that any scammers can be discovered and removed from the market (Aldridge & Décary-Hétu 2014) Potential buyers can use feedback on previous transactions and vendor and product scores to evaluate the likelihood that they are purchasing their desired product from a trusted vendor (Van Hout & Bingham 2013b, as cited in Aldridge and & Décary- Hétu, 2016b). These and other ‘marketplace regulation’ mechanisms (Aldridge et al. 2016; Morselli et al. under review) combine to facilitate trust between anonymous transactors in the absence of face-to-face strategies (Tzanetakis et al. 2016). This can have advantages for both buyers and vendors, for example, because it may make violence as an enforcement mechanism less likely. However, it also means that there are risks associated with entrusting merchandise or cryptocurrency to trade partners (Tzanetakis et al. 2016). Finally, as in the offline world, there is always a risk that a buyer of particular goods or services is actually an undercover police officer (Van Slobbe 2016, 79). More information on the role of trust is included in Section 6.3.3.
3.1.2. Payment
Customers of cryptomarkets tend to pay for products and services with decentralised and cryptocurrencies. Their popularity in online drug marketplaces is due to their secure, anonymous and decentralised architecture. As a virtual asset, rather than traditional printed units of fiat money, cryptocurrency cannot be destroyed or lost completely and new units are impossible to create. When vendors use cryptocurrencies, such as Bitcoins, on cryptomarkets and subsequently launder them with exchangers, this makes it difficult for law enforcement to trace illegal transactions.13 Several authors have described the payment mechanisms for purchasing drugs on cryptomarkets (e.g. Aldridge & Décary-Hétu 2014; Christin 2013; Soska & Christin 2015; Tzanetakis et al. 2016; Van Hout & Bingham 2013a). On Silk Road, only Bitcoin was supported as a payment currency. Bitcoins are not issued by any government, bank or organisation, and can be purchased in person or through online exchanges such as CoinBase. Bitcoins are very volatile, which means that prices of listings are dependent on their actual exchange rate. In June 2016, a bitcoin was worth $538 (or €480), up from $0.83 in March 2011 and $133 in October 2013, when Silk Road 1.0 shut down (bitcoinhelp.net 2016).14 When a buyer wants to make a purchase on a cryptomarket, upfront payment is required. The funds are typically held in deposit, also called ‘in escrow’, by the cryptomarket, thereby allowing the market operator to accurately calculate their commission fees. The escrow system also ensures that any disputes between buyers and vendors could be resolved by the cryptomarket administrators (Aldridge & Décary- Hétu 2014; Christin 2013). Payment is only released to the vendor when the buyer finalised the sale by indicating that the product had been delivered.
13 There is an ongoing debate as to whether cryptocurrencies should be labelled as currencies, because of their extreme volatility in recent years. A requirement for a currency is their relatively stable value. 14 This means that Bitcoin exchange rates need to be taken into account estimating revenues on cryptomarkets.
23 RAND Europe Internet-facilitated drugs trade
Similar to the offline world, there are potential risks of third parties stealing the crypto currency held in escrow. This has happened in the case of the so-called ‘Evolution exit scam’, in which the site's administrators suddenly took their market offline and stole users' currency kept in their escrow accounts (Woolf 2015). Multi-signature escrow, a cryptographic tool that is now offered on some cryptomarkets (see also Section 3.2), avoids some of the scam risks for both vendor and buyer associated with centralised escrow. Sellers with a certain number of successful transactions (in case of Silk Road, it was 35) can request that buyers finalise purchases before the products had arrived (Christin 2013). This practice, marked with ‘FE’ (Finalise Early) in feedbacks ensures that the bitcoins flow directly to the vendor without being held in escrow. It was created as a backup measure in times of high concerns for exit scams or law enforcement seizure, reducing the risk that vendors and buyers lose the funds held in escrow. The risk of vendor scams remains however (LE7). Bitcoins have been the dominant cryptocurrency used on cryptomarkets. They also were the only accepted form of payment on Agora (Tzanetakis et al. 2016). However, as of August 2015, there were 667 running and defunct cryptocurrencies, the most well-known of which were Bitcoin, Litecoin and DarkCoin.15. DarkCoin was accepted as a form of payment on the Nucleus and Diabolus markets in November 2014 (Cox 2016b). In addition, there is a wide range of services available on the dark and clear net that can facilitate opportunities for money laundering (LE15). Cash may be another possibility. Van Slobbe (2016) refers to a case of a buyer from the United States who ordered a series of synthetic drug consignments from a vendor in the Netherlands over the dark web paying with cash. The currency was shipped in envelopes to several addresses in the Netherlands and subsequently collected by the vendor. Although cryptocurrencies are an obvious means of payment on the dark web, apparently they are not a prerequisite.
3.1.3. Communication
Communication between vendor and buyer typically takes place through the market’s direct messaging system. More recently, users tend to encrypt these messages often using PGP (‘Pretty Good Privacy’), a piece of software that provides end-to-end cryptographic privacy and authentication.16 Issues or questions that are relevant to the wider community of cryptomarket users can be shared on the cryptomarket forum. Finally, clear net fora, such as Reddit, are also important means of sharing information (LE11), such as user information, cryptomarket experience, vendor reliability, drug dosage, how a drug works and its effects, combination use, risks, etc. (LE7).
3.1.4. Rules and regulations
Cryptomarkets typically have rules pertaining to the types of products and services they allow for sale on the marketplace and how transactions should take place. While Silk Road operated several rules, for
15 Map of Coins, 2015 ‘View the Bitcoin cryptocurrency specifications in detail,’ As of 11 June 2016: http://mapofcoins.com/bitcoin 16 For an explanation of how PGP encryption works, see Cox (2016b).
24 Internet-facilitated drugs trade RAND Europe instance relating to feedback systems, escrow, payment mechanisms and dispute adjudication, restrictions on what could be sold were comparatively minimal. According to Christin (2013), the Silk Road sellers’ guide prohibited listings that ‘harm or defraud, such as stolen items or info, stolen credit cards, counterfeit currency, personal info, assassinations, and weapons of any kind’ (p.2). Listings related to paedophilia were also restricted. On the other hand, prescription drugs, narcotics, adult pornography and fake identification documents were ‘conspicuously absent’ in the rules (Christin 2013, 2). LE1517 noted that many of the drug markets explicitly state that they will not host Child Sexual Exploitation and Abuse (CSEA) material and most have some policy about commodities which cause harm or will defraud individuals. After reviewing the rules made available in a number of cryptomarkets (AlphaBay, Dream Market, Valhalla, Hansa, Python, Acropolis, Tochka, Cryptomarket, Outlaw and Nucleus), we found that rules for all marketplaces, in the main, could be understood as seeking to reduce particularly third-party harm (also confirmed by LE15). Nine of the ten marketplaces prohibited particular products and services from being listed by vendors for sale (the one that did not may have had rules only accessible for registered vendors, and therefore not visible to us). The most common exclusions were child pornography (also confirmed by LE15) and assassination services, banned weapons or particular subsets of weapons (e.g. bombs, poisons). LE15 noted that apart from the rejection of CSEA material there is a range of responses to other commodities. Alphabay will sell weapons and card dumps but other sites will not engage with these commodities at all (LE15). Marketplace administrators usually take down prohibited listings, and in some cases vendors placing them have been banned. Seven in ten marketplaces listed rules related to transaction and associated security measures. Five marketplaces did not allow vendors to request that customers ‘finalize early’ (i.e. circumvent escrow) or allowed this only to those ‘approved’ to do so. Two marketplaces stated that too many customer reports of vendor scamming would result in a vendor’s account being deactivated. One marketplace (Hansa) described systems to prevent marketplace exit scams. Some marketplaces had stated rules against blackmailing or ‘doxxing’ customers. Three marketplaces explicitly encouraged participants to use security and encryption practices, with one stating that marketplace adjudication would be unavailable to participants not employing such practices.
3.1.5. Shipping of drugs
Cryptomarkets provide dealers with an opportunity to reach a global customer base, compared to a more restricted, local market when dealing in the conventional drug market. The use of postal services is an enabler in this process, and this practice of shipping of drugs purchased on cryptomarkets has been described in several other publications (e.g. Aldridge & Décary-Hétu 2014; Christin 2013; EMCDDA 2015a; Kooistra & Trommelen 2014; Lavorgna 2014; 2016; Mounteney, Griffiths et al. 2016a; Van Hout & Bingham 2013b). Once a transaction on an online marketplace is completed, the vendor ships the drugs to the buyer, primarily via conventional postal or parcel services who are, as Tzanetakis et al. (2016) mentioned, not
17 Unpublished e-mail correspondence, as of 8 April 2016.
25 RAND Europe Internet-facilitated drugs trade aware of the contents they are transporting. Buxton and Bingham (2015) described a court case exemplifying the potential consequences for parcel services unknowingly involved in shipping drugs. FedEx, a shipping company, was charged for money laundering following transportation of drugs without prescription from online pharmacies. The company challenged these charges by indicating that the responsibility for tackling this issue does not lie with shipping companies, but with licensing, regulatory and law enforcement bodies (Buxton & Bingham 2015).18 Christin (2013) listed several ways in which vendors may reduce the risk of detection of their shipped parcels. Vendors claim to know what customs authorities are looking out for, and many of these options are described and in ‘how-to’ guides made available on cryptomarkets or shared on online fora (LE4). One option is for vendors to employ ‘couriers’ instead of going to the post office themselves in person. Furthermore, practices that conceal the content of the package, such as vacuum sealing or ‘professional- looking’ envelopes with typed destination addresses may reduce the risk of inspection (Christin 2013; Basu 2014; Martin 2014b, Mounteney, Griffiths et al. 2016; Tzanetakis et al. 2016; Van Hout & Bingham 2013b; Volery 2015; LE4).19 This might involve an envelope with a DVD case and a logo of an online retailer or resembling a bag of coffee beans (LE1) or using fictitious or real third party logos, such as Unicef (LE2)20. Other practices that minimise the risk of detection include only sending small quantities of drugs at a time in order to fit into an envelope and including a fake return address (Tzanetakis et al. 2016). Stealth packaging practices may be included in vendor pages or mentioned on forums (Tzanetakis et al. 2016; Martin 2014b). More generally, the EMCDDA (2015a) commented that postal or parcel services are still seen as ‘the major bottleneck in the system’ (p. 7) and envelopes or parcels containing drugs could be intercepted by customs.21 Tzanetakis et al. (2016) explained that while privacy of domestic correspondence in general is ‘a liberty and a basic rule of law’ and as such should not be intercepted, customs have the authority to check cross-border items under international drug treaties (p. 9). Thus far, surveillance of outgoing mail from the Netherlands has been limited and the risk of interception for domestic shipments appears to be low (LE2). But out of concern for their ratings, many vendors appear to be reluctant to send items internationally to countries with more stringent law enforcement such as Finland, Australia, the United States and Canada (LE1, LE2, LE9, LE11, EX4, case file).
18 Based on information from Forbes.com, the case continues and the trial will take place in June 2016. More information at: http://www.forbes.com/sites/wlf/2016/05/10/feds-should-absolutely-positively-abandon-bizarre- prosecution-ff-fedex-overnight/#2ef6683a40b2 , as of 11 June 2016. 19 In their study on clear net UK market places selling ‘legal highs’, Schmidt et al. (2011) found that some websites indicated that “discrete packaging” was being used (p. 96). 20 Analysis of the case files reviewed for this study also commented on practices like stealth packaging and using logos from online retailers. 21 See also Aldridge and Décary-Hétu (2016b) for a description of these risks for both vendors and customers.
26 Internet-facilitated drugs trade RAND Europe
3.2. Trends in drugs trade via cryptomarkets
The market for cryptomarkets is relatively concentrated. The figures presented in Chapter 4 show that the three largest markets cover about 65 per cent of all listings. This observation is consistent with network industries theory, which predicts that due to economies of scale in production (i.e. web design), consumption externalities (the utility derived from a user account is based on the total number of listings on a cryptomarket, whereas the utility derived from a vendor account is proportional to the total population of potential buyers), switching costs and lock-in effects (the costs of operating multiple vendor shops on different cryptomarkets) these industries have natural monopolistic characteristics (e.g. Shy 2001,3–6). This would explain the near monopoly that a well-functioning and trusted cryptomarket such as Silk Road 1.0 had until its seizure by the FBI in 2013. Alternative marketplaces appeared quickly afterwards competing for market share, such as Silk Road 2.0, Pandora, Agora, Hydra, and Evolution. In many cases, these market places, based on a profitable business model, were run by a professional team of administrators and moderators (LE9). In November 2014, Silk Road 2.0 and a number of smaller market places were taken down as part of Operation Onymous. Soska and Christin (2015) show that total sales dipped considerably following the intervention, with users shifting to Evolution and Agora. Cryptomarkets are not a static phenomenon. They are subject to evolvement due to technological innovations or in response to scams or interventions. This section discusses several recent developments we observed in the literature or interviews.
3.2.1. Increasing distrust
The success of these markets and their vendors strongly depends on their trustworthiness. Cox (2016a) argues that reputation systems used on cryptomarkets have created a form of self-regulation: ‘vendors who sell low-quality products or who provide poor customer service will simply not receive good ratings, feedback or reviews, so arguably only those providing high-quality products will survive’ (p.52). But in addition to law enforcement intervention, various observers have commented that this trust is gradually being undermined following a series of security failures and scams (e.g. Greenberg 2016; LE7, LE2, EX6). Some even refer to increasing paranoia (LE9). Vendors may scam their customers. But markets have also disappeared following exit scams. Agora ceased operation due to security issues in August 2015 (Cox 2015b). In January 2016, following another reported marketplace scam, DeepDotWeb (2016b) – a website reporting on news about cryptomarkets – stated that it seems like it is ‘the season of small exit scams, previously, a market would wait until it reaches a certain size, or accumulated a certain amount of BTC before pulling the plug and diving with everyone’s money.’ Recently, the second largest cryptomarket (Nucleus) seemed to have shut down unannounced since 13 April 2016, leaving users worried about another exit scam (DeepDotWeb 2016c). In an interview with Wired, Nick Weaver (University of California at Berkeley) summarises the situation: ‘Dark web market admins are learning that “if you’re trustworthy, you stay up for a while, the heat increases, and eventually you get nailed by the feds. […] The most viable exit strategy is to rip and run’
27 RAND Europe Internet-facilitated drugs trade
(Greenberg 2016). An interviewee argued that exit scams even seem to have a higher impact on the market than law enforcement interventions (LE2). The increasing distrust among users of cryptomarkets has gone hand in hand with an ideological decline, observers comment. Whereas in the early days of Silk Road many of those involved expressed strong libertarian motivations and a firm belief in the harm reduction function of cryptomarkets, several interviewees argue that they have been overtaken by commercial interests (EX3, EX13, LE9). Christin states that ‘ideologically, it’s very different now. There’s no longer much of a sense of camaraderie’ (Greenberg 2016). One consequence of the increasing distrust on cryptomarkets has been the need for a risk management strategy by vendors and buyers: ‘don’t put all your eggs in one basket’. This would explain the current situation with several large market places operating in parallel, despite the natural monopolistic characteristics of this network industry.
3.2.2. Mitigating distrust and avoiding exit scams
Previous take downs and arrests of vendors and administrators by law enforcement have led to substantially increased levels of vigilance among cryptomarket users (e.g. EX6, EX18, LE2, LE7). Whereas the (anonymous) users would freely and openly discuss issues on Silk Road forums, these days moderators urge them to suspend any unencrypted communication and use PGP-encrypted emails or messaging instead. Exit scam risk has led to a number of developments that help vendors and buyers reduce their dependence on large cryptomarkets. Some vendors who have gained a good reputation on multi-vendor markets have started their own shop, cutting out the administrator commission as well as the risk of an exit scam (LE1, LE2, LE7, LE9 EX3). DeepDotWeb (2016d) currently lists 18 of those single-vendor shops that allow vendors to deal directly with their customers avoiding the risks associated with third party escrow or the need to pay a commission to the cryptomarket administrators. These may experience more difficulties finding new customers to maintain or grow market share, and therefore they probably keep a presence on large multi-vendor markets as well (LE9). They do not have the critical mass that creates consumer externalities in typical network industries. Furthermore, the risk of vendor scams to customers remains. Alternatives include smaller scale market places that only allow invited buyers or sellers. Darknet Heroes League, for instance, is a collection of old-time vendors with a good reputation, who were invited to sell on this market (LE2). A similar approach, described by LE1, to reducing risks is for vendors and buyers to use other virtual or offline locations to carry out transactions. This means that vendors can use cryptomarkets to publicise their illicit activities, but discuss a possible sale through (encrypted) emails or instant messaging after first meeting via the marketplace. The buyer would therefore not be protected by the escrow services and the cryptomarket administrators but be offered a cheaper price as the vendor does not have to pay a sales commission. In Section 4.8.5 we test whether our data provides any empirical evidence on the prevalence of this practice. If such practices are very common, then our scraped cryptomarket data will likely underestimate vendors’ revenues generated or facilitated by the Tor network.
28 Internet-facilitated drugs trade RAND Europe
3.2.3. Technical innovations
Vendor and market place scams can be prevented by so-called multi-signature transactions, a cryptographic tool that allows buyers to put bitcoins in an escrow account that requires sign-off from two out of three parties – the buyer, the seller, and the site itself – to retrieve the funds (Cox 2016b; Greenberg 2016; Mounteney, Griffiths et al. 2016). Unlike the traditional, centralised escrow, it is impossible to single-handedly retrieve the funds and disappear. However, some observers have argued that it may take some effort to understand the workings of this system, which appears to be hampering the wide adoption of multi-signature escrow (e.g. Weaver in Wired 2016; DeepDotWeb 2016e). As centralised operations are particularly vulnerable to scam risk and law enforcement intervention, other technical innovations allow users to buy and sell products with bitcoin through a peer-to-peer system without a central server (Greenberg 2016; Lewman 2016; LE7; EX3; EX18). Based on this peer-to-peer system, OpenBazaar started operations in April 2016 after a long period of beta-testing (OpenBazaar.net 2016). This model complicates law enforcement intervention and disruption, as operation is distributed over its users, unless individual pages are taken down. Soska et al. (2016) recently introduced a decentralised market place that claims to address some of the short-comings of OpenBazaar. One interviewee expected that all cryptomarket activity will eventually shift to such peer-to-peer marketplaces within next two years (LE7). Others are more sceptical (e.g. DeepDotWeb 2016e). Finally, in efforts aimed at fending off law enforcement, vendors are increasingly innovative. Some have, according to one interviewee (LE7), automated the transaction process using ‘bots’ to communicate with buyers. This helps vendors to avoid having to write messages (which may be subjected to text mining techniques) or deal with personal details.
3.3. Drugs trade and the clear net
The EMCDDA (2015) reported that Europe faces new drug problems and challenges, particularly due to the rise of the Internet-facilitated drugs trade and an increasing prevalence of new psychoactive substances (NPS). This section discusses the role of the clear net, the open part of the Internet, which is indexed by search engines.
3.3.1. NPS web shops
NPS are not typically not controlled by the international drug conventions, but they may pose a public health threat. The EMCDDA signalled the existence of a large number of online shops for NPS in 2013 in Europe (EMCDDA 2015a). NPS often mimic the effects of existing illegal drugs such as cocaine, cannabis, ecstasy or opioids. The legality of NPS can give users the false impression that these are authorised by law and therefore safe, when in fact there is considerable variety in their legal status and various NPS are forbidden by national legislation (EMCDDA 2015a; EMCDDA 2015b). Since January 2016, for instance, seven additional NPS substances have been banned and added to the Opium Act (Opiumlijst) in the Netherlands (EX3). However, various types of NPS are still legal and can be sold online as such, although sites should indicate explicitly that they are not intended for human consumption. NPS web shops therefore typically label their merchandise as ‘research chemicals’ (see for
29 RAND Europe Internet-facilitated drugs trade example Figure 3.2 below). Or as stated on ‘research-chemicals-kopen.nl’: ‘[The] designer drugs sold on this website are intended for research and forensic applications.’
Figure 3.2. Screen shot of a clear net website offering ‘research chemicals’
SOURCE: As of 23 June 2016: http://www.chem.eu NPS web shops tend to have a very basic design common to web shops in other sectors, for example, offering 100mg of 2c-d, a psychedelic drug, for €18.00 only for delivery in the Netherlands.22 Check out may proceed via a shopping basket and payment proceeds via bitcoins or bank transfers. Packages will be delivered within 24 hours by a regular parcel service. Some vendors even offer same-day delivery services by car or motorbike courier, charging premium prices. According to Vardakou et al. (2011, 193), “one firm offers a minimum 5g delivery service within 90min to any address in London, 24h a day, at a cost of £95”. Online herbal, smart or grow shops, such as Shayana.com may offer mushrooms, grow kits or psychedelics. A number of studies have aimed to assess the scale and scope of these NPS web shops (discussed in Chapter 4). An expert suggested that some NPS web shops use the front end as a funnel to a ‘back-shop’ with a broader catalogue that is only accessible to invited customers (EX4).
3.3.2. Online pharmacies
In addition to NPS, Internet has also facilitated the sales of prescription drugs in recent years (Scammel & Bo 2016). Popular products supplied on the web are sexual performance enhancement products (such as Viagra), muscle builders and diet pills, and there have been reports of cancer drugs and stem cells being marketed over the Internet. There is a body of literature focusing on online pharmacies, which are beyond the scope of this study.
22 See for example: http://research-chemicals-kopen.com/product-categorie/2c-d-kopen , as of 11 June 2016.
30 Internet-facilitated drugs trade RAND Europe
3.3.3. Illicit drugs on the clear net
While most literature analysing practices on the clear net focus on online pharmacies and NPS web shops, there is some anecdotal evidence that the clear net is also used for advertising or selling illicit substances. Interviewees mentioned the existence of several web shops that offered cocaine or cannabis (EX3, LE1), using web addresses that suggest other (legal) activities, such as ‘horse auctions’ (paardenveiling.nl). Advertisements tend to be only online for a few days, but these websites may exist for multiple years. One interviewee indicated that come shops on the clear net sell cutting and bulking agents that can be used for illicit drugs trade (EX15). Some online sources (e.g. Cox 2015a) also pointed to clear net websites that are offering illicit substances including MDMA, methamphetamine, and cocaine, using an Amazon-style web shop look-and-feel and requiring payment in bitcoins (e.g. ‘Chemical Love’ and ‘Forbidden Market’). Additionally, the New York Times profiled sites from China that were shipping illegal narcotics (Levin 2015). For example, on ‘guidechem.com’, more than 150 Chinese companies sell alpha-PVP, a stimulant that is illegal in the United States and the majority of EU countries. We did not, however, identify any studies that systematically analysed the scale of illicit drugs trade via clear net markets.
3.3.4. Apps and social media
Apps and social media have particularly had a role in communicating about drugs and their use. Smartphone apps, such as ‘How to sell weed’ or ‘Leafy App’ offer instructions about how to produce, sell and buy drugs (EMCDDA 2015a), or YouTube, which is used to communicate about drug use methods (e.g. Krauss et al. 2015). Cavazos-Rehg et al. (2014) analysed a pro-cannabis Twitter handle with approximately 1 million, overwhelmingly young, male followers. Websites and apps can have an indirect role by using marketing to share experience and opinions about different types of drugs, but more directly, they connect potential buyers and vendors. Particularly, social media such as Twitter, Facebook, Tinder (LE16) and Instagram as well as online fora (in particular Reddit), are reported to be used to bring vendors and potential buyers together (e.g. Daily Pakistan 2015; Drugabuse.com undated; Michaels 2014; Phelan 2014; The Guardian 2016; LE11), or to advertise cryptomarkets, including codes to access them (EX10). While academic research on this topic is limited, (anecdotal) media reports provide some insights. In the case of Instagram and Twitter, the potential customers can use the hashtags system to easily identify sellers. By using explicit keywords (hashtags) as ‘#weedforsale’, the name of a specific drug such as ‘#mdma’, or other code terms, the potential buyer can directly connect to a seller and contact him through direct messaging services such as Whatsapp or Kik. Different modalities of payment, including Bitcoins, and delivery are then possible. This practice had been observed already in 2013, when Instagram blocked searches for certain terms associated with the suspected illegal sale of drugs via its service (BBC 2013). A law enforcement official discussed instances in which Facebook was used by vendors to advertise their drugs, both through using encrypted messenger but also by using their own names (LE16). In the case of Tinder, the dating app that facilitates the meeting of people in the same geographical area, The
31 RAND Europe Internet-facilitated drugs trade
Guardian (2016) recently reported that potential customers can simply swipe through profiles until they find a drug dealer in their area. The use of social media for illegal purchasing has been documented in the case of illegal access to drugs of abuse via online pharmacies. Mackey and Liang (2013) posted a fictitious advertisement of no- prescription drugs23 online to social media platforms (i.e., Facebook, Twitter, Google+, and MySpace), and demonstrated that there are few barriers to social media–based illicit online drug marketing. Katsuki et al. (2015) established an empirical link between Twitter content and illicit online pharmacies that promote the illegal sale of prescription drugs that have significant abuse potential. The study also identifies Twitter as a potential source for information, illegally promoting the sale of controlled prescription drugs directly to consumers.
23 The marketing and sale of prescription drugs as ‘no prescription necessary’.
32
4. The size and shape of Internet-facilitated drugs trade
This chapter primarily addresses research questions focussed on the scale and scope of Internet-facilitated drugs trade (research questions’ clusters A, B, and partially C, see Table 1.1). As described in Chapter 2, our analysis in this section (and throughout the study) largely focuses on cryptomarkets, with some information collected about ‘clear net’ web shops selling legal psychoactive substances. In relation to the latter, information was collected through a review of the limited literature on clear net sales (which primarily relates to the relatively large number of single vendor-type web shops identified within Europe). In relation to the former, the analysis is based on a review of the literature that has emerged in recent years (including academic literature, grey literature, and importantly in this area, work by journalists and independent researchers) as well as the new empirical data collected for this study. We contribute to this literature connected to our own empirical investigation of data collected for this project: data scraped in January 2016 from eight of the largest cryptomarkets, including 105,811 listings placed by 3,846 vendors worldwide (see Chapter 3 Methodology). The resulting dataset is, to our knowledge, the most up-to-date and comprehensive at this juncture. We complement this marketplace data and information from the literature with insights from expert interviews. Our analyses aim to characterise these marketplaces in terms of substances sold by the vendors who place listings for sale on cryptomarkets. We were also able, by examining volume of trade (transactions and revenues generated), to generate understanding of which categories of drug are most important on these marketplaces, and the extent to which cryptomarkets may be serving a ‘wholesale’ function for customers sourcing stock for redistribution. We examined changes in connection to all these analyses by comparing our multiple market results – which we estimated to represent about 80 per cent of total cryptomarket listings in January 2016 – to an analysis conducted on the first and at the time only major drug cryptomarket, Silk Road 1.0, shut down by the FBI in September 2013. To this end we used data collected in the few weeks before its closure to examine trends. We present results for all our analyses for vendors worldwide, but also for those separately for vendors indicating they ship drugs from the Netherlands, most of whom we believe are likely to have a base of operations in this country. Finally, we examined sales of products and services that are not drugs themselves, but some of which are drug-related (e.g. lab equipment, paraphernalia) or services that may support those involved in drug supply activity (e.g. money laundering).
33 RAND Europe Internet-facilitated drugs trade
4.1. Previous studies reporting on the size and shape of Internet- facilitated drugs trade
Several studies provide quantitative analyses of drug markets on the dark and clear net with varying methods, aims and scope and time periods covered. For example, methods applied range from conducting primary research by using a bespoke data crawler to systematically index cryptomarkets (e.g. Aldridge & Décary-Hétu 2014; Christin 2013; Soska & Christin 2015), systematically conducting searches in search engines to identify and analyse clear net markets (the ‘snapshot’ methodology as used by e.g. Martinez et al. 2016), or creating a user profile on the dark net to monitor these markets (Van Buskirk et al. 2014) to do secondary research in which other, existing data sources were used (e.g. Bartlett 2015; Ciancaglini et al. 2015). These studies differed in their clarity or transparency of the methods applied. In the study by Ciancaglini et al. (2015), for example, cryptomarket data were used that were collected from a specific website, without further explaining how these data were originally collected or what markets were included in ‘all marketplaces’ (p. 10). Phelps and Watt (2014) did not elaborate on the specifics and potential caveats in monitoring users of Silk Road, and did not explain the criteria used for selecting a group of Australia- based vendors. And Dolliver’s (2015) analysis of Silk Road 2.0 data has been criticised by various authors (see Aldridge & Décary-Hétu 2015b; Buskirk et al. 2015; Munksgaard et al. 2016; Soska and Christin, 2015) because its main conclusion was that the marketplace was used most and foremost to sell eBooks. Serious doubts have been raised about the accuracy of Dolliver’s data collection given this finding that is at odds with all other research. The identified studies also differed in terms of aims and scope: some studies, in particular the studies on the clear net market, did not aim to examine the full market, but only looked at a particular type of drugs (e.g. Nizar et al., 2015) or a market for a specific country (e.g. Kooistra & Trommelen 2014 who looked at the Dutch market). This caveat affects the extent to which statements concerning size of the online drug market can be made. Finally, the studies were conducted at different points in time: from the identification of clear net websites offering ‘the possibility to purchase drug-related items’ in 2003 (Schifano et al. 2006, 643) to long-term analyses of cryptomarkets between 2013 and 2015 (Soska & Christin 2015). These studies and relevant findings are presented in Table C1 (cryptomarkets) and Table C2 (clear net) of Appendix C for further reference, and used as individual examples throughout this report where relevant. As several clear net studies applied the so-called ‘snapshot methodology’, a description of this methodology is discussed in more detail in Box 4.1.
34 Internet-facilitated drugs trade RAND Europe
Box 4.1. The snapshot methodology
The Psychonaut 2002 EU project used a so-called ‘snapshot’ methodology to monitor drug-related content on the Internet (Schifano et al. 2006). Specific enquiries were entered in Google and AltaVista, which resulted in a ‘time- specific picture of the existing websites’ (Martinez et al. 2016, 97; Schifanoet al. 2006). This methodology was further developed by the EMCDDA, who published several articles with updated snapshot findings of online shops in Europe selling NPS, with the most recent snapshot identifying 651 online shops in 2013 (see Table C2 in Appendix C for a full overview of EMCDDA findings and study details) (EMCDDA 2015a). The European Commission funded researchers from five countries (Czech Republic, France, the Netherlands, Poland and the United Kingdom) to develop this snapshot methodology further under a project called ‘I-TREND’ (Internet Tools for Research in Europe on New Drugs) (Martinez et al. 2016). As described by Martinez et al. (2016), the project ‘aimed, among other things, to develop a software-automated tool for monitoring online shops using a less resource intensive method than had been available previously’ (p. 97). In sum, this methodology can be best understood as a repeated cross-sectional study design, in which the types of substances and search engines used can vary over time.
4.2. The number and size of online marketplaces for drugs
Only a few years ago, Silk Road had virtual a monopoly on the dark web; it was the first cryptomarket dedicated primarily to the sale of illicit drugs. The market quickly gained popularity and ran successfully for about two and a half years until it was shut down by the FBI in October 2013. By that time several rival marketplaces had appeared. Silk Road 2.0 (SR2) was launched only weeks after the closure of its name sake. Throughout 2014, several other markets opened with Pandora, Agora, Hydra, and Evolution competing with SR2 (Aldridge & Décary-Hétu 2016b). Some markets disappeared again. Most prominently, Evolution closed in March 2015 with its administrators reportedly having seized $12mworth of bitcoins held in escrow (Woolf 2015). Although there was variation in the number of markets analysed and methods used, several studies identified in the literature review reported on findings relating to the number of dark and clear net markets and their drug listings. Although there were a few primary studies examining (a selection of) cryptomarkets and their accompanying listings, the exact number of market places for drugs available on the clear net remains unknown. However, a project such as I-TREND aimed to assess the availability of online shops selling NPS in particular countries (Martinez et al. 2016).
4.2.1. Cryptomarkets and their listings
At the time of publication of this report, there are approximately 50 cryptomarkets and vendor shops on the dark web according to the website DeepDotWeb.com.24 As of mid-February, there were 19 active cryptomarkets with at least 400 listings each, either for drugs or non-drug related products (see Table 4.1). As explained in Section 2.3, the dark web crawler used in this study (DATACRYPTO) monitored a total of eight cryptomarkets yielding 105,811 listings (for all goods, not just drugs) in mid-January. In addition to these eight, Table 4.1 also includes the cryptomarkets that were not monitored by DATACRYPTO. In total, these markets reported to have a total of 27,000 listings in their category menus in mid-February.
24 Online, available at: http://deepdotweb.com , as of 23 June 2016.
35 RAND Europe Internet-facilitated drugs trade
Taken together, we estimate the total number of listings across all marketplaces therefore to be 133,061, suggesting therefore that the January DATACRYPTO scrape on which our results are based captured 80 per cent of all listings across all cryptomarkets.25 It is very likely that the total of number of listings on cryptomarkets that were not monitored by the DATACRYPTO tool will actually be lower than the estimates we derived using marketplace-generated listing number metrics, because the administrators of these cryptomarkets may have an incentive to inflate the advertised number of listings on their market to raise the credibility of their cryptomarket. The 80 per cent estimate is therefore a likely underestimate of the proportion of all cryptomarkets listings that were analysed in this report. Of course, there is a possibility that the 80 per cent of listings we analysed were not representative of all the cryptomarket listings but the odds of error are small in this case since the DATACRYPTO tool analysed old, new, large as well as small cryptomarkets. Many more cryptomarkets appeared to be active, but they have fewer than 400-500 (self-reported) listings or they did not provide enough information for us to ascertain their size and scope. This is often the case with cryptomarkets specific to particular regions such as France or Russia. The well-known Russian Marketplace (RMP) has been active since 2012. As part of our previous work, we managed to create an account and browse the market but could only find a small number of vendors offering products with little apparent activity. This is not to say that this market was not used by many Russian nationals. But the information publicly available on the cryptomarket did not suggest that this is the case. These smaller cryptomarkets were not included in Table 4.1 as we only focused on the larger cryptomarkets for this report. Observers noted however a growing trend in cryptomarkets towards more geographically localised markets and this should be considered in future studies. At the time of writing, the research team could not identify any market targeted specifically at Dutch buyers. In addition to these multi-vendor cryptomarkets, interviewees reported the emergence of a number of single-vendor markets as an important trend (LE2, EX3, LE9). According to DeepDotWeb, there were 18 single-vendor markets on the dark web in April 2016.
25 There are reasons to suspect that self-reported metrics from cryptomarkets are inflated, but it was not possible to investigate this hypothesis further for this report. Should it be the case that cryptomarket-generated metrics are inflated, this would suggest that the 80 per cent of listings we collected for the present analyses is a lower limit: in other words, we may have captured an even larger percentage proportion of total listings across all cryptomarkets. Even without assuming marketplace inflation of listing numbers, our capture of 80 per cent of listings suggests good coverage and representativeness.
36 Internet-facilitated drugs trade RAND Europe
Table 4.1. Distribution of the listings on active cryptomarkets in January/February 2016
Monitored by Name DATACRYPTO for this Date of creation Number of listings study AlphaBay Yes 2014/12/22 37,896 Cryptomarket Yes 2014/12/22 8,362 Dark Net Heroes League Yes 2015/05/27 387 Dreammarket Yes 2013/11/13 22,284 French Dark Net Yes Unknown 1,307 Hansa Yes 2015/07/18 4,829 Nucleusa Yes 2014/10/24 26,538 Python Yes 2015/07/10 4,208 Sub-total 105,811 Valhalla (Silkkitie) No 2013-10-01 11,000 Dr. D's Market No 2015-02-20 4,000 German-Plaza No 2015-04-01 3,700 Outlaw Market No 2013-12-29 2,000 TheRealDeal No 2015-03-31 2,000 Oasis Market No 2015-12-20 2,000 Acropolis Market No 2015-11-06 700 Tochka No 2014-01-30 500 Aflao Market No Unknown 500 Dark Rabbit No Unknown 450 Bloomsfield No 2015-12-24 400 Sub-total 27,250 TOTAL 133,061 NOTE: a Nucleus, in February 2016 the second largest market after AlphaBay, seemed to have shut down since the 13th of April (DeepDotWeb, 2016). With regard to the literature on cryptomarkets and their listings, most of the studies based on primary research found that the majority of listings on the dark web are related to drug items. Between 2011 and 2012, Christin (2013) crawled Silk Road 1.0 for eight months, in which he identified 24,400 unique items (not just drug listings). The main categories are related to narcotics or controlled substances of which cannabis appeared to be most popular category with 3,338 items available (13.7 per cent of all items). In their long-term analysis of 16 cryptomarkets between 2013 and 2015 (excluding those with volumes of <$1,000 or those that could not be observed), Soska and Christin (2015) identified a total of 78,509 item listings (all listings, not just drugs) with valid observations. Aldridge and Décary-Hétu (2014), who analysed Silk Road 1.0 in September 2013, identified 11,904 active listings related to drugs (11,853 relevant listings included for analysis), with prescription drugs (3,953) and cannabis (2,661) accounting for most of the drugs listings, followed by psychedelics (1,539), stimulants (1,274), ecstasy (1,059) and opioids (262). In contrast, one study based on crawling Silk Road 2.0 between August and September 2014 estimated this market to be less drug-focused (348 out of 1,834 items were drug items) (Dolliver 2015). However, the findings from this study should be treated with caution, as some authors
37 RAND Europe Internet-facilitated drugs trade suggested that the data collection may have resulted in only a partial dataset (e.g. Aldridge & Décary- Hétu 2015b; Buskirk et al. 2015; Munksgaard et al. 2016; Soska & Christin 2015), therefore generating potentially misleading results.
4.2.2. Clear net markets and their listings
We did not identify any studies that aimed to estimate NPS revenues on the clear net market. However, studies did report on the number of online web shops for selected NPS or countries (e.g. Bigdeli et al. 2013; Corazza et al. 2014; EMCDDA 2009; 2011a; 2011b; Hillebrand et al. 2010; Lahaie et al. 2013; Martinez et al. 2016; Nizar et al. 2015; Schmidt et al. 2011; Van Buskirk et al. 2013; 2014). Hillebrand et al. (2010), for example, found 69 online shops in the EU in 2008. As mentioned in Box 4.1, the EMCDDA identified 651 online shops in Europe selling and shipping NPS to EU Member States in 2013 (EMCDDA & Europol 2013). In comparison, this was 314 in 2011 (EMCDDA 2011a). Although looking at five countries in particular (Czech Republic, France, the Netherlands, Poland and the United Kingdom), project I-TREND identified 584 online shops between 2013 and 2014.
4.3. Types of drugs offered via Internet
Access to illegal drugs globally varies considerably in spite of globalising processes, with availability connected to international economic relationships between and among countries (e.g. the ‘Global South’ versus the ‘Global North’) and in connection to available shipping routes and proximity to the production countries (Boivin 2014). This section will focus how cryptomarkets facilitate the trade of different types of illicit drugs.
4.3.1. Cryptomarkets
Table 4.2 presents the share of listings for each drug type at the international level and for listings likely to be held by vendors based in the Netherlands. However, not all listings generate sales (across all these markets, only 20 per cent of listings had generated a sale in the previous month). Counting listings must therefore be understood as telling only a very limited story about what drugs are available for purchase on cryptomarkets; counting listings does not tell us which drugs are actually sold. We attempt to describe the drugs actually sold in subsequent sections of this report.
Proportion of listings that are for drugs Our results (Table 4.2) show that about 57 per cent (60,337) of scraped listings offered drugs on the eight included cryptomarkets in January 2016. The absolute number of drug listings has therefore increased about six-fold, compared to data collected by Aldridge and Décary-Hétu (2014) from Silk Road 1.0 in September 2013. Observers noted that the proportion of non-drug listings have increased since then. This is an important change, since drug listings represented the vast majority of listings on Silk Road. Our data do not allow us to ascertain the reason for cryptomarkets now including more non-drug sales of goods and services, but it may be that worldwide media, law enforcement and policy attention drawn to cryptomarkets allowed vendors of these non-drug products and services to see potential in these platforms.
38 Internet-facilitated drugs trade RAND Europe
Types of drugs offered We grouped all drugs listings, based on the categories provided in Appendix A. Cannabis listings were most common across all drug listings on the eight markets (30 % of all drug listings). Prescription drugs (24 per cent), ecstasy (17 per cent), stimulants (13 per cent) and psychedelics (11 per cent) follow in descending order. Non-prescription opioids (e.g. heroin) made up 3 per cent of drug listings, with listings for alcohol and tobacco (< 1 per cent) relatively infrequent. Taken together (cannabis, ecstasy, psychedelics) there is a predominance of drugs typically associated with recreational or ‘party’ use, although some categories include substances associated with dependence (e.g. oxycodone within the ‘prescription’ category; methamphetamine in the ‘stimulants’ category, and heroin in the ‘opioids’ category. Several interviewees confirmed the predominance of recreational drugs available on cryptomarkets (e.g. EX4, EX6, EX15, EX18).
Table 4.2. Categories of drug listing for sale (‘All’ and ‘Dutch’ only drug listings)
ALL DRUG LISTINGS DUTCH DRUG LISTINGS N % N % Alcohol + tobacco 70 <1% 0 0% Cannabis 18,369 30% 986 15% Ecstasy type 9,972 17% 2,725 42% Prescription 14,511 24% 365 6% Psychedelics 6,622 11% 915 14% Stimulants 7,852 13% 1,328 20% Opioids 1,979 3% 172 3% Other drugs 962 2% 47 1% Total 60,337 100% 6,538 100%
Literature and interview responses appear to corroborate most of our findings in relation to the type of drugs sold and their relative proportions, and provide some context and explanation (e.g. EX4, EX3, EX6, LE15). Van Buskirk et al. (2013; 2014), for instance, who looked at the number of retailers selling substances to Australia, found that between 2012 and 2013, cannabis, NPS and MDMA were the most commonly available on Silk Road 1.0 (Van Buskirk et al. 2013) and cannabis, pharmaceuticals and MDMA most commonly available on Agora, Evolution, Silk Road 2.0, Pandora and Cloud Nine between July and December 2014 (Van Buskirk et al. 2014). EX4 suggested that the substance types available online mirror consumption patterns offline, with our results confirming that the substances most likely to be available on cryptomarkets are also those with the highest prevalence of use, at least in the countries of the Global North (primarily Europe and North America), in particular cannabis and ecstasy, followed by cocaine and methamphetamine. While, according to the EMCDDA, heroin still constitutes the second largest illicit drug market (after cannabis) in the EU with a retail value estimated between €6.0 and €7.8bn, most experts concur that its market share on cryptomarkets is relatively small. EX3 and LE14 suggested a reason that substances like heroin may be less often sold on cryptomarkets could be due to the fact that buying on cryptomarkets
39 RAND Europe Internet-facilitated drugs trade requires an element of planning; this may not suit the daily use of dependent users, particularly those with chaotic lifestyles. Nevertheless, heroin listings alone amounted to 2.7 per cent of all drug listings. While clear net markets tend to be dominated by NPS, some interviewees (e.g. EX12) concurred that they play a much smaller role on cryptomarkets.
Types of drugs listings by Dutch vendors We undertook an analysis looking at the types of drugs offered by ‘Dutch Vendors’, and found that the distribution across drug categories was markedly different compared to vendors not categorised as ‘Dutch’. A majority of listings were for ecstasy-type drugs (42 per cent), followed by non-prescription stimulants (20 per cent). Similar percentages of listings were found for cannabis (15 per cent) and psychedelic drugs (14 per cent), with listings for prescription drugs (6 per cent) were relatively infrequent compared to the overall picture. Several interviewees were also of the view that the drugs offered for sale by Dutch vendors were different (e.g. LE2). The divergent picture for the Netherlands (likely also the case for other individual countries) reflects a complex interplay of variables, including legal context, differing ‘tolerance’ for drug use, and location in relation to drug production and trafficking. These observed differences may be explained by longstanding policies of tolerance towards ‘soft drugs’ (a point also noted by LE2),26 combined with the fact that much MDMA is manufactured in the Netherlands, alongside the country’s importance to drug trafficking operations connected to its shipping ports.
Retail versus wholesale We note also that buyers on cryptomarkets may not always be purchasing for personal use, with some customers sourcing stock online for offline distribution (Aldridge & Décary-Hétu 2016a). We found that most listings for heroin (~75 per cent) across the eight markets were priced under $500, with 12 per cent priced over $1,000, which suggests a ‘wholesale’ phenomenon. The rationale for the designation of ‘wholesale’ as transactions priced over $1,000 is discussed in more detail below. We undertook an analysis looking at the types of drugs offered by ‘Dutch Vendors’, and found that the distribution across drug categories was markedly different compared to vendors not reporting to ship from the Netherlands. A majority of listings were for ecstasy-type drugs (42 per cent), followed by non- prescription stimulants (20 per cent). Similar percentages of listings were found for cannabis (15 per cent) and psychedelic drugs (14 per cent), with listings for prescription drugs (6 per cent) relatively infrequent compared to the overall picture.
4.3.2. Clear net markets
Studies identified in our literature review into web shops selling substances on the clear net, primarily looked at the sale of NPS (e.g. EMCDDA 2009; 2011a; 2011b; Hillebrand et al. 2010; Martinez et al. 2016; Nizar et al. 2015). The details of the types of listings such as those available from studies that crawled the dark net were not commonly examined (or reported) for the clear net, with a few exceptions.
26 This in spite of recent policy development introducing stricter criteria for coffee shops (e.g. Spapens et al. 2014).
40 Internet-facilitated drugs trade RAND Europe
Hillebrand et al. (2010), for example, found more than 500 unique items being advertised on 27 selected online shops, with salvia divinorum (a psychoactive plant) being listed by the majority of the selected websites (74 per cent) between February and June 2008. Between 2012 and 2013, a study monitored websites that were willing to ship to Australia and listed the ‘number of retailers selling the ten most common EPS’ (‘Emerging Psychoactive Substances’) (Van Buskirk et al. 2013, 5). It was found that 6- APB (Benzo Fury), Ethylphenidate and aMT were most popular among retailers willing to ship to Australia (Van Buskirk et al. 2013).
4.4. Revenues of drugs trade
This section presents the results from our primary data collection on cryptomarkets and summarises the literature on both dark and clear net. Several studies have signalled the role of the Internet in facilitating drugs trade. As explained below and in our methodological description, it is more difficult to assess drug revenues for clear net market places than for cryptomarkets. Clear net sites tend to have a relatively short time span. And estimating the quantities of drugs traded is more difficult for websites that do not collect and publish information about transactions (c.f. feedback on cryptomarkets). Furthermore, and as explained elsewhere in this report, most studies examining the clear net were not primarily aimed to assess the size of Internet-facilitated drugs trade. As such, there were no studies identified that estimate revenues of clear net web shops.27
4.4.1. Cryptomarkets
Total revenues We measured revenues or turnover that drug vendors generate by selling on these marketplaces (we did not measure profits; see Section 2.3.2.3 for how we measured revenue) for eight cryptomarkets monitored by DATACRYPTO. Analysis of these markets suggests a total monthly revenue of $14.2m (€12.6m) for all drugs listings and $12.0 million (€10.6m) when prescription drugs and alcohol and tobacco are excluded (see Table 4.3). As explained in Section 2.3, this will likely be an underestimate of the total revenues of drugs trade via cryptomarkets, as these estimates are based on customer feedbacks for eight of the largest market places. Based on the approach explained in Section 2.3.2.3, an upper-boundary estimate for monthly drug revenues on all cryptomarkets would be $25.0m (€22.1m) and $21.1m (€18.7m) when prescription drugs and alcohol and tobacco are excluded.28 Revenues generated by vendors who indicated shipping from the Netherlands amount to $1.1m (€977,000) for all drugs listings and $1.1m(€962,000) when prescription drugs and alcohol and tobacco
27 There was one study that referred to an operation conducted by the US Drug Enforcement Administration in 2004, which found that some vendors of hallucinogens online had sales of up to $20,000 per week (Schifano et al. 2006). 28 This upper-boundary estimate does not include revenues via potential stealth listings (see Section 2.3.2.8), nor does it compensate any potential seasonal effects (see Section 2.3.2.3), as there is no information about these phenomena to draw any meaningful assumptions.
41 RAND Europe Internet-facilitated drugs trade are excluded (see Table 4.3). These figures represent 8.9 per cent and 9.1 per cent of the total cryptomarket revenues respectively. When trying to extrapolate these results to an annual revenue figure, one needs to take into account that the period between mid-December and mid-January (the window of measurement) is not necessarily representative in terms of substance consumption for the rest of the year. For these reasons (and other) it is difficult to provide an estimate of the scale of online trade vis-à-vis offline trade. Aside from the methodological issues related to estimating cryptomarket drugs revenues (see section 2.3.2.2), one will need to separate wholesale transaction from retail to avoid double counting. Notwithstanding the aforementioned limitations, differences in the order of magnitude between our results and those generated for the total retail value of drug markets suggested that the drugs revenues on cryptomarkets are relatively small compared to offline trade. Acknowledging a range of caveats, the EMCDDA and Europol (2016) estimate that the 2013 EU retail drug market is estimated to be worth at least €24bna year (i.e. €2bn on average per month). While our estimates for cryptomarkets refer to international drugs trade revenues (as opposed to EU alone),29 they still deviate by a factor of about 200. This was echoed by one expert who believed that the scale of the phenomenon (i.e. drugs trade facilitated by the Internet) has been overstated, whereas in fact its actual share in drugs trade is relatively small (EX3). Looking just at ‘Dutch Vendors’ our analysis of the eight markets found that the total drugs revenues for ‘Dutch vendors’ were around €1mper month (Table 4.3). For comparison, Dutch coffeeshops were recently estimated to generate an average monthly revenue in the range of €70-100mfor cannabis alone (Bieleman et al. 2015). Further, the scale of money laundering in the Netherlands is estimated at around €1.35bn per month (Korps landelijke politiediensten, KLPD 2013). On the other hand, it becomes clear that the Netherlands’ pivotal role in production of synthetic drugs off line is replicated online. Other researchers studying drug cryptomarkets have also attempted to measure revenues. As can be found in Table C1 of Appendix C, only a limited number of studies identified in the literature review provided an estimate of total revenues of cryptomarkets based on primary research (Aldridge & Décary-Hétu 2014; 2016a; Christin 2013; Kooistra & Trommelen 2014; Soska & Christin 2015). There were a few instances where an estimate was provided for a selection of vendors based on secondary data (Barrett 2015), or where the methods used were not clearly defined (Buxton & Bingham 2015). Christin (2013), based on data collected between 2011-2012, estimated the revenue for both drug and non-drug related listings on Silk Road 1.0 to be a total of around $15m annually. One year on (2013), Aldridge and Décary-Hétu (2014) estimated the total revenue of Silk Road 1.0 (drug listings only) to be $89.7m annually at the end of 2013 – an increase on the Christin’s estimate from 2013. Soska and Chrisin (2015), in their long-term measurement analysis of several cryptomarkets, calculated that revenues on Silk Road 1.0 (across the marketplace, not just drugs) were around $300,000 per day in the summer of 2013, translating to over $100m annually. Across seven markets for which they calculated revenues, the daily revenues for all goods sold were in the $550,000 to $650,000 range (Soska & Christin 2015). With regard to the Dutch share on these markets, (for all listings, not just drugs) Kooistra and
29 Albeit primarily in the Anglo-Saxon world and Western Europe.
42 Internet-facilitated drugs trade RAND Europe
Trommelen (2014) estimated this on Agora to be 12 per cent (of €81m total revenue) and 7 per cent on Silk Road 2.0 (of €64m total revenue) in 2014. Evidence therefore indicates steady and substantial increases in drug revenues on cryptomarkets over time, and similar increases are found for Dutch vendors.
Revenues by type of drug As indicated in C1 in Appendix C, Aldridge and Décary-Hétu (2014; 2016a) reported on revenues on cryptomarkets by type of drugs. The authors found that cannabis generated the largest amount of revenue (compared to other drugs) on a monthly basis ($2,038,213), with ecstasy and stimulants generating $1,613,840 and $1,330,989 respectively (Aldridge & Décary-Hétu 2016a). Although not calculating the revenues per type of drug, Soska and Christin (2015) found that at equilibrium (i.e. when a market is restored after an event like a large scam) and across all markets analysed, cannabis and MDMA each accounted for roughly 25 per cent of revenues. This was 20% for stimulants and just under 10 per cent each for psychedelics, opioids and prescription drugs (Soska & Christin 2015). Kooistra and Trommelen (2014) found that most revenues to ‘Dutch vendors’ were generated by ecstasy (29 per cent) and cannabis (27.5 per cent) across four cryptomarkets (see Table C1 in Appendix C for other categories). When looking at the size of trade for individual drug types, again we saw a different picture emerging when examining actual sales compared to counting listings for drugs on the eight markets. For example, only 13 per cent of the listings were in the ‘stimulant’ category (see Table 4.2), but these generated nearly a quarter (24 per cent) of all the drugs monthly revenue. By contrast, listings in the prescription drug category accounted for nearly a quarter of all drug listings (Table 4.3), but generated only 15 per cent of all drug revenue. This demonstrates the importance of revenue analysis when attempting to understand drug selling activity on cryptomarkets.
Table 4.3. Sales (estimated monthly transactions and revenue) across drug categories (‘All’ and ‘Dutch’ only drug listings)
ALL DRUG LISTINGS DUTCH DRUG LISTINGS Transactions Revenues in Transactions Revenues in % % % % in last month last month in last month last month Cannabis 30,790 33% $4,436,803 31% 1,289 17% $103,376 9% Stimulants 17,206 18% $3,461,023 24% 2,135 29% $276,498 25% Ecstasy-type 11,031 12% $2,262,850 16% 2,188 29% $527,541 48% Prescription 17,984 19% $2,185,147 15% 371 5% $17,436 2% Psychedelics 9,993 11% $1,020,059 7% 1,054 14% $115,446 10% Opioids 5,241 6% $751,021 5% 422 6% $59,686 5% Other drugs 465 <1% $71,457 1% 30 <1% $4,079 <1% Alcohol+tobacco 63 <1% $2,683 <1% 0 0% $0 0% Total 92,774 100% $14,194,043 100% 7,488 100% $1,104,063 100%
43 RAND Europe Internet-facilitated drugs trade
Cannabis produced (31 per cent) of drugs revenue across all drug listings (and 37 per cent when alcohol, tobacco and prescription drugs are excluded), but substantial revenue was also generated in the other drug categories. Revenues for stimulants constitute 24 per cent of total revenues (and 29 per cent when alcohol, tobacco and prescription drugs are excluded). These patterns are more or less coherent with the total market shares of these substances in the EU (EMCDDA 2016a), where the cannabis market makes up about 38 per cent of the total retail value and cocaine constitutes 24 per cent (see Table 4.4). The main differences can be found in ecstasy and opioids (which includes heroin). Whereas ecstasy-type drugs generated 16 per cent cryptomarket revenues (19 per cent when alcohol, tobacco and prescription drugs are excluded), they only constitute 3 per cent of the total EU retail value. As discussed above, opioids tends to be underrepresented on cryptomarkets with opioids only generating 5 per cent of revenues (6 per cent when alcohol, tobacco and prescription drugs are excluded), compared to a total retail market share for heroin of 28 per cent in the EU. Sales for alcohol and tobacco were a very small share of drugs revenues across the cryptomarkets analysed, likely reflecting the fact that these can be purchased legally, albeit with restrictions, in most jurisdictions. There are some differences between the shares of transactions and revenues, caused by the average values of transactions. Prescription (15 per cent) and ecstasy-type drugs (16 per cent) generated similar proportions of revenue, but prescription drugs had proportionately more transactions. Psychedelic drugs and opioids also generated substantial monthly transactions and revenue, but in smaller proportions compared to the other drug categories.
Table 4.4. Estimated total minimum retail value of the illicit market for the main drug types in the EU (in billions EUR, USD and per cent)
Retail value Market share Drug type Annual (EUR) Average per month (USD)
Cocaine €5.7bn $0.53 bn 23% Heroin €6.8bn $0.63 bn 28% Amphetamines €1.8bn $0.17 bn 7% Cannabis €9.3bn $0.87 bn 38% Ecstasy €0.7bn $0.07 bn 3% Total €24.3bn $2.3 bn 100% NOTE: The drug categories used by EMCDDA deviate slightly from those identified by DATACRYPTO. Cocaine and amphetamines are in our 'stimulants' category, and heroin is in our opiates category. Monthly USD estimates are based on an exchange rate EUR/USD of 1.14 SOURCE: EMCDDA (2016a)
Revenues by type of drug for vendors shipping from the Netherlands The market shares of different drug types are markedly different for ‘Dutch vendors’. Our revenue analysis demonstrated concentration primarily in two drug categories that the listing count did not reflect. Ecstasy-type drugs generated nearly half (48 per cent) the overall revenue generated by Dutch listings (compared to 16 per cent for all vendors), with stimulants generating another quarter of monthly drug revenues for these vendors. Roughly 9 per cent of overall Dutch drug cryptomarket revenue was generated
44 Internet-facilitated drugs trade RAND Europe by cannabis and 10 per cent by psychedelics. Revenue generated by prescription drug sales for ‘Dutch’ listings was very small (2 per cent) in contrast to the overall picture (15 per cent). The revenue generated by opioids (5 per cent) was similar between ‘Dutch’ listings and listings placed by vendors elsewhere. Ecstasy-type listings generate much higher revenues than their number of transactions would suggest. Inversely, cannabis listings generate fewer revenues than expected when looking at their number of transactions. The overall picture for the Dutch context is that ecstasy-type drugs and stimulants are dominant, accounting for nearly three quarters of all the revenue generated by Dutch listings.
4.4.2. Clear net markets
As mentioned in Section 4.2.2, no studies were identified that estimated NPS revenues made on clear net markets, but studies did report on number of online shops. Other studies for example looked at a particular type of NPS (e.g. Nizar et al. 2015, who aimed to identify new NPS), or only looked at a market for a specific country (e.g. Schmidt et al. 2011, who looked at the UK market). As such, these findings should be treated with caution as they did not primarily aim to provide a revenue estimation. Schmidt et al. (2011) did comment on the revenues on the legal highs’ market in the United Kingdom more generally (£10m), yet the distribution of offline and online sales was not mentioned.
4.5. Wholesale versus retail
Early publications on drugs trade via Silk Road have dubbed it the ‘ebay for drugs’ (Barratt 2012, 683), suggesting similarities with the California-based e-commerce company offering consumer-to-consumer and business-to-consumer sales services via the internet. Aldridge and Décary-Hétu (2014) concluded however that Silk Road was not just a business-to-customer marketplace, but that there was evidence that ‘many customers on Silk Road will have been drug dealers sourcing stock, and that in revenue terms, these kinds of ‘business-to-business’ sales were key Silk Road business’ (p. 16). This section investigates the extent to which transactions on cryptomarkets and clear net markets (Section 4.5.4) can be characterised as business-to-business and business-to-consumer in more detail.
4.5.1. Not just an e-bay for drugs?
Ebay is primarily a retail platform, rather than wholesale. There is evidence from our research, and others, that cryptomarkets are used by both retail and wholesale buyers. In their revised approach for calculating wholesale transactions on Silk Road 1.0, Aldridge and Décary-Hétu (2016a) found that a quarter of the revenue was generated by wholesale transactions. In 2014, journalists Kooistra and Trommelen (2014) reported that 61 per cent of all analysed transactions from ‘Dutch vendors’ on four cryptomarkets had a value of more than one bitcoin.30 It was not specified what kind of drugs these transactions reflected. They also found that some ‘Dutch vendors’ were open for negotiations with buyers when bulk purchases were ordered (Kooistra & Trommelen 2014). Van Slobbe (2016) further noted that there have been examples in the Netherlands and other countries of criminal investigations where ‘buyers first [purchased]
30 At the time Kooistra and Trommelen (2014) conducted their research, one bitcoin was €450 (the study did not refer to dollar value) and the study used this number to explain the possibility of bulk purchases.
45 RAND Europe Internet-facilitated drugs trade small quantities of drugs and then, once a degree of trust has been established between the vendor and the purchaser, [proceeded] to purchase a large consignment for trade’ (p. 78). Several interviewees mentioned that online drug markets were also business-to-business marketplaces, where dealers sold and purchased wholesale quantities online (e.g. EX1, EX4, EX10, EX13, LE2, LE9, LE16).
4.5.2. Distinguishing wholesale from retail listings
Despite these (sometimes anecdotal) comments on and research into wholesale, there is little guidance in the research literature as to what actually constitutes a wholesale or a retail volume. Volumes associated with wholesale vary considerably depending on type of drug, and legal thresholds that trigger supply offences vary considerably from jurisdiction to jurisdiction, with many indicating relatively small quantities consistent with personal use (Aldridge & Décary-Hétu 2016a). Rather than developing a framework that categorizes wholesale and retail sales based on weight, we adopted a classification of listings based on price, and do so consistently across all drugs. The quantities involved in most purchases priced under $100 are sufficiently small as to be unlikely to include many – if any – purchases intended for profitable resale. We anticipate that listings priced at $1,000 and over are much more likely to be ‘wholesale’ purchases made by those intending later distribution. However, some purchasing at this level may be buying for personal use over the longer term. The designation is admittedly arbitrary, although some validation of this approach is found in the literature (Aldridge & Décary-Hétu 2016a). It is more difficult to be confident about listings priced between $100-$1000, and so we employed four price categories in the analyses that follow, with listings priced over $1000 as the – likely conservative – cut-off point for classifying ‘wholesale’ transactions. Table 4.5 presents the distribution of prices inside each category.
Table 4.5. Distribution of drug listing prices within four price categories ('All' and 'Dutch' only drug listings)
ALL DRUG LISTINGS DUTCH DRUG LISTINGS N % Mean S.D. N% Mean S.D. <= $100.00 27,412 46% $45 $27 2,623 40% $45 $26 $100.01 - $500.00 20,418 34% $233 $108 2,028 31% $237 $110 $500.01 - $1,000.00 5,123 9% $709 $141 630 10% $698 $149 $1,000.00+ 6,814 11% $4,428 $9,202 1,245 19% $5,722 $8,139 TOTAL 59,767 100% 6,526 100%
Most listings are included in the first two categories. At the international level, the most expensive listing was priced at over $390,000 (a listing for 10 kilos of cocaine). For the bottom three categories, the mean price falls roughly in the middle between the lower and upper bound with reasonable standard deviations. For the ‘wholesale’, prices average around $4,500 but have a much wider distribution (SD = $9,202). Dutch drug listings have a very similar pattern, although the listings in the top category are priced higher on average ($5,722 vs $4,428). These listings offer a smaller variation as indicated by the standard deviation (SD = $8,139). The most expensive listing from the Netherlands is priced just below $70,000
46 Internet-facilitated drugs trade RAND Europe
and is a custom listing for 22,000 pills, 2 kg of MDMA and 450 g of cocaine. Another similarly priced listing offered 5 kg of ketamine with a stated purity of 80 per cent. Listings placed by ‘Dutch vendors’ were nearly twice as likely to be in the ‘wholesale’ price category, with nearly one in five listings (19 per cent) priced over $1,000; listings in the lower priced categories (at or under $500) are correspondingly fewer. This suggests that the Netherlands is relatively more important (compared to all other countries combined) in wholesale distribution, a finding that perhaps reflects the fact that the Netherlands is a transit and production country particularly for MDMA and some other synthetic stimulants, alongside cannabis (UNODC 2014). As we discussed above, the number of listings can be a misleading indicator of activity on cryptomarkets. Table 4.6 presents the distribution of sales and revenues across the price categories. The bulk of transactions are generated by low priced listings under $100. Wholesale listings account for only 2 per cent of transactions, and even using the less conservative ‘wholesale’ estimate, only 6 per cent of all transactions are wholesale. This suggests that most cryptomarket transactions are consistent with purchase for personal use or ‘social supply’ redistribution. The situation is very similar in the Netherlands where there are slightly more transactions in the under $100 range and slightly fewer transactions in the $100– $500 range. At the international and Dutch level, the majority of transactions (94–95 per cent) are concentrated in the lower drug price categories (up to $500).
Table 4.6. Transactions, revenues and market share of drug listings ('All' and 'Dutch' only drug listings)
ALL DRUG LISTINGS DUTCH DRUG LISTINGS Transactions Revenues in Transactions Revenues in % % % % in last month last month in last month last month <$100.00 59,684 64% $2,560,429 18% 5,058 68% $202,180 18% $100.01 - $500.00 28,066 30% $5,776,298 41% 2,007 27% $427,739 39% $500.01 - $1,000.00 3,296 4% $2,302,270 16% 299 4% $203,993 18% $1,000.00+ 1,728 2% $3,552,046 25% 124 2% $270,151 24% Total 92,774 100% $14,184,498 100% 7,488 100% $1,104,063 100%
Even though small in number in comparison to retail transactions, these wholesale transactions are important in the marketplace: cryptomarkets continue to cater for customers making high price/quantity purchases, and one quarter of all the revenue generated on the marketplace is generated by transactions priced above $1000. The distribution of revenue across price categories for ‘Dutch vendors’ compared to the overall picture is broadly similar, with wholesale transactions accounting for about a quarter of the revenues across all listings, and for Dutch listings. The predominance for the offering of wholesale priced listings for ‘Dutch vendors’ does not translate into sales; actual wholesale activity is similar. This finding highlights the limits of assessing supply using the number of listings to describe cryptomarkets.
47 RAND Europe Internet-facilitated drugs trade
4.5.3. Wholesale transactions by type of drugs
Table 4.7 presents the transactions by substance type, similar to Table 4.3, but this time only for wholesale priced transactions. For all drug listings, relative contribution to revenues of different drug types at the wholesale level roughly mirrors that found for all trade (see Table 4.3). Wholesale represents roughly 25 per cent of sales generated in all drug categories except for alcohol and tobacco where there were no wholesale sales.
Table 4.7. Sales (estimated monthly transactions and revenue) across drug categories for wholesale priced drugs only (over $1,000) ('All' and 'Dutch' only drug listings)
ALL DRUG LISTINGS DUTCH DRUG LISTINGS Transactions in Revenues in Transactions in Revenues in % % % % last month last month last month last month Cannabis 596 34% $1,112,858 31% 6 5% $6,301 1% Stimulants 406 24% $873,464 25% 13 11% $31,318 12% Ecstasy-type 321 19% $763,853 22% 89 72% $189,588 70% Prescription 268 16% $581,593 16% 0 0% $0 0% Psychedelics 86 5% $149,207 4% 12 10% $34,763 13% Opioids 41 2% $61,318 2% 4 4% $8,180 3% Other drugs 9 1% $9,753 0% 0 0% $0 0% Alcohol+tobacco 0 0% $0 0% 0 0% $0 0% Total 1,728 100% $3,552,046 100% 124 100% $270,150 100%
For Dutch listings, however, the picture is very different. Wholesale activity is most concentrated for drugs in the Ecstasy-type category (70 per cent). Some wholesale revenue was found for psychedelic (13 per cent) and stimulant drugs (12 per cent), but wholesale revenue for other drug categories for Dutch listings was negligible. This means that wholesale at the Dutch level are very much concentrated in this single drug category. Compared to the international level where we found evidence of many different drugs being offered at the wholesale level and generating revenues, at the wholesale level, ‘Dutch vendors’, at least in the eight sites included in this study, appeared very much to specialise, probably reflecting the status of the Netherlands as a producer country for this drug (UNODC 2014).
4.5.4. Wholesale and social distribution via clear net markets
Like buyers who purchase illicit drugs on cryptomarkets, substances purchased on the clear net (primarily NPS) are sometimes also bought for re-sale purposes (e.g. Benschop et al. 2015; Cadet-Taïrou et al. 2013; DrugScope 2014; EMCDDA 2011a; Lavorgna 2014; Nizar et al. 2015; Stephenson & Richardson 2014; The New Psychoactive Substances Review Expert Panel 2014). Focusing on the Netherlands, Benschop et al. (2015) and Nabben et al. (2014) reported that some buyers resell large quantities of NPS bought online to others. The UK Advisory Council on the Misuse of Drugs (2011), informed by experts, argued that the growth of the NPS market appears to have given rise to the entrepreneurial drug dealer, who seizes the
48 Internet-facilitated drugs trade RAND Europe opportunity to make profits while substances remain legal. According to this Advisory Council, many of these dealers appeared to be new to the drugs trade and included students. TREND (Emerging Trends and New Drugs) sites in Bordeaux, Metz and Lille, set up as part of the TREND scheme established by the French Monitoring Centre for Drugs and Drug Addiction in 1999, observed that buyers who purchase NPS online also engage in direct sales – in other words, users and individual dealers who are not part of an organised crime network obtain products from the internet and subsequently share those drugs with friends or engage in micro traffic (Cadet-Taïrou et al. 2013). Similarly, Lavorgna (2014) suggested that, based on case studies of law enforcement operations and interviews with law enforcement representatives and experts from Italy, the USA and the Netherlands, some young ‘psychonauts’ are involved in small-scale trading: ‘[…] they have basically added an organizational layer to the trafficking chain by acting as local retailers for their (extended) circles (organizational opportunities). Even if most of these psychonauts seem to be involved in small-scale trades, a couple of interviewees underlined that in some recent cases the quantities purchased imply that some transactions are directed towards retailers operating on a larger scale (from business-to-consumer to business-to-business)’ (p. 267).
4.6. Volumes of drugs on offer
Given the wide range of drugs offered on cryptomarkets, it would be difficult to present the quantities of the many hundreds of drugs available for sale. We therefore opted to present the average weight of drugs per listing by price range for three exemplar drugs: cannabis, cocaine and MDMA powder. Table 4.8 presents our analysis of the cannabis, cocaine and MDMA powder subsample.
Table 4.8. Mean weight (g) of exemplar drugs in four price categories ('All' and 'Dutch' only listings)
ALL LISTINGS DUTCH LISTINGS MDMA MDMA Cannabis Cocaine Cannabis Cocaine powder powder <= $100.00 9.8 1.9 6.2 11.7 1.2 3.9 $100.01 - $500.00 29.4 3.4 14.3 26.8 4.3 22.7 $500.01 - 115.2 10.2 46.0 79.7 10.5 71.2 $1,000.00 $1,000.00+ 505.8 141.6 478.8 863.0 138.2 712.6
There is a very strong relationship between the price of a listing and its weight, with the average weight of a listing rising steadily across all price categories. This suggests that our decision to use price as a proxy for quantity (much more complicated to discern, assess and compare across drug types) has some validity. This relationship was true for all exemplar drugs across both the Netherlands and the international level. Our results demonstrate that large quantities of drugs were available, especially for cannabis and MDMA powder. In the case of cannabis, the mean weight of listings from the Netherlands was over 850 g, making it very likely that wholesales are the most common form of transactions at the top price category. Cocaine
49 RAND Europe Internet-facilitated drugs trade weights were smaller than their cannabis and MDMA powder counterparts, but given their higher price per gram, the revenues generated at the top quartile are likely to be important as well. These results suggest that while price is a reasonable proxy measure for quantity sold, interesting variations are evident when we drill down looking between drug types and countries. Here for example, when comparing the ‘Dutch listings’ to international listings, the average quantities for cannabis and MDMA were considerably higher for listings priced over $1,000. This again likely reflects the status of the Netherlands as a producer country for these drugs (UNODC 2014).
Table 4.9. Volume (in grams) traded on marketplaces over the previous month (weight*transactions) for exemplar drugs ('All' (A) and 'Dutch' (B) only listings)
(A) ALL LISTINGS
Cannabis Cocaine MDMA powder <= $100.00 94,244 (19.9%) 2,947 (10.5%) 5,769 (11.8%) $100.01 - $500.00 147,759 (31.1%) 11,425 (40.8%) 19,312 (39.4%) $500.01 - $1,000.00 84,949 (17.9%) 5,252 (18.8%) 9,684 (19.7%) $1,000.00+ 147,502 (31.1%) 8,358 (29.9%) 14,296 (29.1%) TOTAL 474,455 (100.0%) 27,982 (100.0%) 49,062 (100.0%)
(B) DUTCH LISTINGS
Cannabis Cocaine MDMA powder <= $100.00 3,461 (32.2%) 618 (23.4%) 1,408 (12.3%) $100.01 - $500.00 5,847 (54.4%) 1,182 (44.7%) 4,158 (36.4%) $500.01 - $1,000.00 653 (6.1%) 491 (18.6%) 2,628 (23.0%) $1,000.00+ 786 (7.3%) 351 (13.3%) 3,238 (28.3%) TOTAL 10,747 (100.0%) 2,642 (100.0%) 11,432 (100.0%)
Overall, we found that, the eight cryptomarkets examined facilitate the sale of nearly 475 kilos of cannabis a month. As a group, ‘Dutch vendors’ sell about 11 kg a month, just 2% of the total global volume of cannabis we estimate to be traded on cryptomarkets. The distribution of volume across price illustrates the same pattern as we observed looking at transactions in the $100 – $500 price range. Indeed, it is the price category associated with the largest volumes of substances sold, both for ‘Dutch’ and ‘international’ vendors.
4.7. Other goods and services
There are a range of other products or services offered for sale on cryptomarkets. Some may be used by customers to produce, manufacture, grow or synthesise drugs; others, ‘paraphernalia’ are involved in drug consumption (e.g. vaporizers). Aldridge and Décary-Hétu (2014) previously analysed precursors sold on Silk Road 1.0 and concluded that the sale of ‘precursors’ (as classified by vendors) ‘demonstrated that Silk
50 Internet-facilitated drugs trade RAND Europe
Road may have helped to put not only access to bulk purchases of illicit drugs (or their precursors) into the hands of those without existing criminal connections to make these purchases offline, but may also have placed the kinds of skills previously restricted to trained and experienced chemists with an understanding of illicit synthesis into the hands of anyone with the time and inclination to learn’ (p. 16).
4.7.1. Products and services supporting the drugs supply chain
Our cryptomarket analysis aimed to capture the sales of other goods and services that support the supply chain of drugs. Table 4.10 presents the statistics of the sale of these products in our cryptomarket scrape.
Table 4.10. Sales (estimated monthly transactions and revenue) for goods supporting drug production, supply and use ('All' and 'Dutch' only listings)
ALL LISTINGS DUTCH LISTINGS Transactions in Revenues in Transactions in Revenues in N N last month last month last month last month Drug paraphernalia 1,239 545 $12,230 8 0 $0 Cutting agents 74 63 $5,948 4 0 $0 Drug precursors 89 37 $5,524 5 0 $0 Equipment/guides/shipping 927 404 $4,725 0 0 $0 Total 2,329 1,049 $28,427 17 0 $0
Products and services supporting drug production, supply and use are listed on drug cryptomarkets, and generate sales, albeit in negligible amounts in comparisons to drugs themselves. The total revenue generated by these products and services in the month prior to data collection ($28,427) was about 0.2 per cent of the amount generated by drug sales (over $14m). We coded substances used as precursors in drug production only where those substances were not also taken as drugs. Ephedrine, for example, is used as a precursor in the production of methamphetamine, but is also used as a stimulant drug in its own right. Items coded as precursors are listed in Table 4.11.
Table 4.11. Items coded as precursors
3,4-methylenedioxyphenyl-2-propanone Methanol Acetic anhydride Nitric Acid Acetone Amphetamine oil Ethyl ether APAAN Hydrochloric acid (HCI) Lysergic acid Dichloromethane Phenylacetone (1-Phenyl-2-Propanon) P2NP Potassium permanganate Potassium cyanide Safrole Xylene Sulphuric acid Aluminium powder Toluene Potassium iodide Sodium hypophosphite Isopropyl alcohol Red Phosphorus Mercury dinitrate Methylamine N-Butylamine.
51 RAND Europe Internet-facilitated drugs trade
There were only 89 listings for drug precursors, but for the reason stated above, it is likely that other substances sold on cryptomarkets will be used by those purchasing them as precursors in drug production. The precursor listings here generated a very small number of transactions and associated revenue. We found a similar fairly small number of listings (74) for cutting agents generating similar sales. There were substantially more listings (927) for equipment and shipping-related products (e.g. bags), and guides to drug production and shipping. These had many more transactions associated with them than we found for precursors and cutting agents, but revenue generated by these was similarly low, suggesting these were low-priced items, many of which could be sourced legally in most jurisdictions. Listings for drug paraphernalia (e.g. filter papers, vaporisers, rolling machines, filters) were more numerous (1,239), and these generated slightly more substantial transactions and revenue. This is perhaps unsurprising, since these products are legally available in most countries in high street shops and on the Internet. Listings for all products supporting drug production, supply and use were minimal in the Netherlands (only 17 listings overall), and generated no sales in the month prior to our data collection.
Table 4.12. Other supporting goods and services
ALL LISTINGS DUTCH LISTINGS Revenues Revenues Transactions in Transactions in N in last N in last last month last month month month Financial products and services 1,932 2,939 $270,840 14 55 $1,170 Counterfeit IDs 1,251 570 $30,343 1 0 $0 Equipment for doing business 260 71 $3,488 3 0 $0 Counterfeit prescription templates 5 0 $0 0 0 $0 Guides 2,767 1,588 $6,350 4 3 $7 Total 6,215 5,168 $311,021 22 58 $1,177
Among all non-drug listings, some were products or services that might be supportive in some way for vendors selling drugs on cryptomarkets, although these were not necessarily exclusively aimed at, or indeed used by, drug vendors. These included financial products and services31, equipment for doing business32, counterfeit IDs33, counterfeit prescription templates and guides or ‘how-tos’34. The level of transactions and revenue generation for all these was small, although it is worth noting that many of these listings did not qualify as consumables (e.g. guide to money laundering), as drugs do, so re-purchase by a customer is unlikely – a customer is unlikely to purchase the same tutorial eBook multiple times but may
31 This category includes online accounts of bitcoins, financial accounts, financial transfer services, money laundering and other money services. 32 This category includes bank card readers, cellphones, computers and electroniselectroniselectronicselectronis. 33 This category includes counterfeit template IDs, scans and physical IDs, passports and diplomas. 34 This category includes guides on bitcoins, counterfeiting, the dark web, drugs and security.
52 Internet-facilitated drugs trade RAND Europe purchase listings for 1 g of cannabis many times over. The most commonly listed type of product was the financial products and services, which can help vendors launder the proceeds of their sales or the customers to purchase bitcoins, still a difficult task for many. Counterfeit IDs, which can be used for identity fraud or reducing the risks when arrested, were also popular. The Netherlands appeared to be absent from these activities as only the financial products and services category produces revenues over $1,000. Interestingly, a small number of listings for templates for producing prescription templates (5) could have been used by prescription drug vendors to source stock, although we saw no sales for these in the month associated with our data collection.
4.7.2. Do vendors sell other products in addition to drugs?
Vendors on cryptomarkets are free to offer as many listings as they wish across a wide range of product and service types, with some individual vendors holding thousands of listings. Table 4.13 presents a Pearson correlation between the activity of selling drugs and of selling other types of drug-related and non-drug-related products.
Table 4.13. Correlation between the different vendor activities
Correlation to selling drugs Selling supply and production tools -.016 Selling drug paraphernalia .039* Selling counterfeit products -0.333** Selling eBooks -0.426** Selling digital information -0.298** Selling fraud products and services -0.502** Selling miscellaneous legal products -0.166** Selling services -0.320** Selling software -0.296** Selling weapons -0.060** Pearson correlation; N = 3,846; * < 0.05; ** < 0.01.
Most correlations were significant and negative, suggesting that drug vendors are less likely to offer products unrelated to drugs than non-drug vendors. Unsurprisingly, the only positive correlation with selling drugs was selling drug paraphernalia. The strongest negative correlations were between selling drugs and selling eBooks and fraud products and services. This suggests that vendors tend to specialize either in the sale of drugs or in the sale of other types of products, even though fraud products, services and guides (e.g. laundering) may be useful purchases by drug selling vendors; it is possible that these vendors may be customers for these non-drug, but supportive products, although our data are unable to shed light on precisely who makes purchases. Table 4.14 below examines overlap in types of products sold by vendors. Looking first at the international picture, we see that 71 per cent of all vendors have at least one drug listed, with a majority of vendors (58 per cent) only selling drugs and nothing else. This suggests that cryptomarkets in 2016 remain drug
53 RAND Europe Internet-facilitated drugs trade dominated. Only 5 per cent of vendors sell only drug-related products. However, nearly three in 10 vendors (29 per cent) sell only products that do not include drugs. On the Dutch side, vendors show substantially more specialisation in drug sales. Almost all vendors (93 per cent) have at least one drug listing. The vast majority sell only drugs (83 per cent). This leaves a very small minority of ‘Dutch vendors’ (7 per cent) who do not sell drugs. This is a very striking difference to the overall picture, demonstrating that ‘Dutch vendors’ use cryptomarkets almost exclusively for drug sales.
Table 4.14. Distribution of vendors’ activities
ALL VENDORS ‘DUTCH VENDORS’ # % of total # % of total Sell drugs 2,744 71% 215 93% Sell drugs and nothing else 2,248 58% 192 83% Sell drugs and drug-related productsa 151 4% 6 3% Sell drugs and non-drug-related products 345 9% 17 7% Sell anything but drugs 1,102 29% 15 7% Sell anything but drugs and drug-related products 1,044 27% 13 6% Sell anything but drugs and non-drug related products 58 2% 2 1% Total 3,846 100% 230 100% NOTE: a Drug-related products refer to drug production supplies and drug paraphernalia.
4.8. Trends in Internet-facilitated drugs trade
Up until late 2013, Silk Road controlled virtually all cryptomarket drugs trade. Since this time there has been considerable change, with new markets emerging every few months. This section will seek to compare the data collected from the eight cryptomarkets included in this study in 2016, to data collected from to Silk Road in September 2013, only weeks before the site was taken down by the FBI (results of some of the 2013 data are presented in Aldridge and Décary-Hétu 2014). Given that Silk Road was the dominant cryptomarket at the time, the two samples we present should be representative of the state of cryptomarkets in 2013 and 2016 (eight cryptomarkets sampled). Both samples were collected using the same methodology and the same tool, DATACRYPTO, though the Silk Road sample was collected using a much less sophisticated version of the tool (see Section 2.3). The difference in automation should not impact the reliability of the data collection process. For the 2016 and 2013 datasets, we compared the types of drugs offered, the price categories, the total revenues and market share of different drug types, and the listings, transactions and revenues per vendor.
4.8.1. Types of drugs offered
Table 4.15 presents the differences in the types of products offered on cryptomarkets in 2013 and 2016.
54 Internet-facilitated drugs trade RAND Europe
Table 4.15. Trends in categories of drug listed: Silk Road September 2013 to multiple markets January 2016
JANUARY 2016 SEPTEMBER 2013 N % N % Alcohol + tobacco 70 <1% 262 2% Cannabis 18,369 30% 2.493 23% Ecstasy type 9,972 17% 1,045 10% Prescription 14,511 24% 3,842 35% Psychedelics 6,622 11% 1,521 14% Stimulants 7,852 13% 1,071 10% Opioids 1,979 3% 172 2% Other drugs 962 2% 430 4% Total 60,337 100% 10,927 100%
Our results suggest relative stability in the type of drugs being offered on cryptomarkets. Psychedelics, stimulants, opioids and other drugs have all remained relatively stable over time. In 2016, cannabis took a larger share of listings, as do ecstasy listings. Listings for prescription and psychedelic drugs had a smaller overall share of listings than in 2013. This represents a shift in cryptomarkets towards more recreational drugs.
4.8.2. Price categories
As mentioned above, the price of listings can be a good indicator of the proportion of retail and wholesale sales on cryptomarkets. Table 4.16 presents the distribution of listings across four price categories. Listings in the top quintile could be considered as wholesale.
Table 4.16. Number of listings within four price categories: Silk Road September 2013 to multiple markets January 2016
JANUARY 2016 SEPTEMBER 2013 N % N % <$100.00 27,412 46% 5,328 49% $100.01 - $500.00 20,418 34% 3,854 35% $500.01 - $1,000.00 5,123 9% 830 8% $1,000.00+ 6,814 11% 915 8% Total 59,767 100% 10,927 100%
The distribution of the price of listings presented in Table 4.16 has remained broadly stable over the past 3 years, changing only of a few percentage points. Listings in the retail price category have decreased by a small amount, with a corresponding small increase in wholesale priced listings. There is therefore no indication that the share of wholesale listings has increased over the past years.
55 RAND Europe Internet-facilitated drugs trade
4.8.3. Revenues and market share
As discussed above, transactions and revenues are more accurate measures of the activity of cryptomarkets than just the total number of listings. Table 4.17 presents the distribution of both for Silk Road and for the multiple markets in 2016.
Table 4.17. Revenues and market share: Silk Road September 2013 to multiple markets January 2016
JANUARY 2016 SEPTEMBER 2013 Transactions in Revenues in Transactions in Revenues in % % % % last month last month last month last month <$100.00 59,684 64% $2,560,429 18% 22,306 64% $1,260,996 17% $100.01 - $500.00 28,066 30% $5,776,298 41% 11,245 32% $3,099,883 43% $500.01 - $1,000.00 3,296 4% $2,302,270 16% 902 3% $1,052,400 14% $1,000.00+ 1,728 2% $3,552,046 25% 575 2% $1,851,947 25% Total 92,774 100% $14,184,498 100% 35,028 100% $7,265,226 100%
Although the number of listings across markets in January 2016 has risen nearly six-fold (see Table 4.16), the total number of monthly drug transactions has risen only around threefold, and overall monthly revenue generated by drug sales has only just doubled, from $7.3m to $14.2m (Table 4.17). We believe the increases we document are ‘real’ and not an artefact of our research design, data collection methods or concept operationalisations.35 Various interviewees noted that revenues on cryptomarkets are growing (e.g. LE9, EX13), although most did not base this on empirical data. The distribution of revenues remained virtually unchanged over the period, with one quarter (25%) of all revenues generated by wholesale priced items. This indicates that the average purchase on cryptomarkets in 2016 was smaller than it was in 2013 ($153 on average versus $207). Another interesting change over the period (not presented in the table) is that the number of listings with associated transactions dropped to 20% overall (from 42 per cent in Silk Road). This is probably due to the increased number of listings and the heightened competition from the three-fold increase in numbers of vendors, while sales have only doubled.
35 Indeed, if anything, our estimates are under-estimates for the reasons outlined in Section 2.3 (we captured fewer transactions through customer feedback than in September 2013; further, it is possible that our December–January data collection period did not cover purchases made in advance of heavier seasonal drug use).
56 Internet-facilitated drugs trade RAND Europe
Table 4.18. Sales (estimated monthly transactions and revenue) across drug categories, Silk Road September 2013 to multiple markets January 2016
JANUARY 2016 SEPTEMBER 2013 Transactions in Revenues in Transactions in Revenues in % % % % last month last month last month last month Alcohol+tobacco 63 <1% $2,683 <1% 152 <1% $5,158 <1% Cannabis 30,790 33% $4,436,803 31% 10,663 31% $2,038,213 28% Stimulants 17,206 18% $3,461,023 24% 4,898 14% $1,330,989 18% Ecstasy-type 11,031 12% $2,262,850 16% 3,982 11% $1,613,840 22% Prescription 17,984 19% $2,185,147 15% 6,612 19% $999,872 14% Psychedelics 9,993 11% $1,020,059 7% 5,925 17% $879,451 12% Opioids 5,241 6% $751,021 5% 2,015 6% $284,972 4% Other drugs 465 <1% $71,457 1% 735 2% $103,304 1% Total 92,774 100% $14,194,043 100% 34,982 100% $7,255,799 100%
When we examined the size of the trade of different types of drugs over time, the overall picture is more one of stability than change (also indicated by EX18). We did see some change, however, when we compared transactions and revenues generated within each drug category (both as a proportion of drugs revenue generated overall) between September 2013 and just over two years later, in January 2016. The following changes were observed. Proportionately speaking, numbers of listings for psychedelic drugs dropped to an extent over the period (see Table 4.15). However, the proportion of overall drug transactions and revenue generated by psychedelic drugs dropped from 17 per cent and 12 per cent (respectively) to 11 per cent and 7 per cent (see Table 4.18). We also noticed a drop in the revenues of ecstasy (from 22 per cent of revenues to 16 per cent of revenues) though the proportion of transactions remains stable. Cannabis was on the rise both in terms of number of listings but also in terms of revenues and transactions. The proportion of revenue generated by stimulants rose from 18 per cent to 24 per cent, as did transactions for this drug (from 14 per cent to 19%). These results are more or less consistent with findings by Soska and Christin (2015), who showed that the fraction of market share by drug category was relatively stable between July 2013 and January 2015. In their results, cannabis sales constituted between a quarter and a third of all cryptomarket revenues, while MDMA and stimulants both remained fairly stable around a fifth during this period.36 Soska and Christin reported a little less than 10 per cent of market share for both psychedelics and prescription drugs. The main difference is probably in the share of opioids, which was reported around 10 per cent compared to only 5 per cent in our results. However, this difference can be explained by the categorisation method used. Many drugs can be coded as either a prescription or an opioid and depending on how these drugs are coded, the relative size of categories will either increase or decrease. Soska and Christin do observe several downward spikes in cannabis revenues reaching as much as half of the market share. These spikes correspond to the take-down of Silk Road (October 2013), closure of
36 Note that these figures represent market share of all products and services, including non-drugs.
57 RAND Europe Internet-facilitated drugs trade
Black Market Reloaded and the Sheep Marketplace scam (December 2013), the Silk Road 2.0 theft (March 2014) and Operation Onymous (January 2015).
4.8.4. Listings, transactions and revenues per vendor
This section has demonstrated so far that listings, transactions and revenues have evolved between 2013 and 2016. This section presents results that suggest that the profile of drug vendors has also changed during that period.
Table 4.19. Trends relating to cryptomarket vendors between September 2013 (SR1) and January 2016 (All cryptomarkets)
JANUARY 2016 SEPTEMBER 2013 Min Max Mean S.D. Min Max Mean S.D. Number of listings per vendor 1 611 22 43 1 339 11 23 Number of active listings per vendor 1 257 9 14 1 73 5 6 Number of transactions in last month per vendor 0 1,709 34 78 0 187 5 12 Revenues in last month per vendor $0 $276,231 $5,189 $15,410 $0 $28,233 $673 $1,974 N = 2,744 N = 1,031
The number of cryptomarket drug vendors has more than doubled from 1,031 in 2013 to 2,744 in January 2016.37 We note, however, as discussed in the methods section, that determining the number of vendors relies on imperfect strategies for matching vendors with multiple accounts within and across marketplaces. For this reason, our estimate of the number of vendors active in January 2016 is probably an overestimate, as will be our estimate of the growth in the number of vendors over the period. Although we cannot know by precisely how much we are overestimating vendors in the post-Silk Road 1.0 era, growth is nevertheless apparent. This is consistent with findings from other research. Christin (2013) reported that the number of vendors on Silk Road 1.0 (almost all of whom sold drugs) increased from 220 in November 2011 to 564 in July 2012. For the group of vendors selling to and within Australia, Van Buskirk et al. (2013) found that this increased from 282 vendors mid-September 2012 to 374 in early February 2013. For the clear net, they noted that the number of vendors selling to Australia went up from 92 in September 2012 to 101 in February 2013 (Van Buskirk et al. 2013). In their follow-up study in (using slightly different methods, see Table C2 in Appendix C), they found this number to be 67 in July 2014 and 78 in December 2014 (Van Buskirk et al., 2014). Soska and Christin (2015) also reported that the total number of vendors on cryptomarkets has considerably increased since the days of Silk Road. By the time Silk Road stopped activities in October
37 Note that we did not undertake the same vendor-matching exercise using the Silk Road 1.0 data for two reasons: (1) most vendors at the time did not have a PGP key on which to undertake matching; and (2) given that there was only one market of note at the time, there was arguably less motivation for vendors to hold multiple accounts, although this may still have happened. The relatively high price of the vendor bond on Silk Road 1.0 at the time may further have dissuaded vendors from having multiple accounts.
58 Internet-facilitated drugs trade RAND Europe
2013, it featured around 1,400 vendors. Over their entire measurement interval, they collected a list of 9,386 unique vendors across the crawled marketplaces (see Table C1 in Appendix C for more study details). Most law enforcement interviewees agreed that this picture of considerable growth in the number of vendors is consistent with their observations. The findings from Soska and Christin (2015) are also consistent with our finding that numbers of listings have increased since 2013 (see Table 4.16). This increase in the number of listings can be explained in part by a rise of the average number of listings per vendor (from 11 to 22). Many vendors operate on multiple cryptomarkets and probably have similar listings across each. This could explain why some vendors now manage a much higher number of listings. The maximum number of listings by a single vendor was 611. This vendor appeared to be shipping from North America and Asia and to ship to multiple countries, offering multiple categories of prescription drugs. This vendor’s revenues over the past month were $5,000. Vendors are also much more active in terms of transactions than they were in 2013. The average number of transactions per vendor has risen from five to nine transactions per month. The most active vendors are also much more active with upwards of 1,700 transactions in a single month. This has led to an increase in the average revenue per vendor per month. This figure has risen more than seven-fold over the last three years. Some vendors appeared to be making large amounts of money on cryptomarkets as the most successful vendor made an estimated $276,230 over the last month, a ten-fold increase over the most successful vendor in 2013. Others fall at the other end of the spectrum with $0 in estimated revenues over the last month. Figure 4.1 displays the distribution of estimated revenues by vendor, showing that more than half of the vendors make $1,000 per month.
Figure 4.1. Distribution of estimated revenues across vendors
1800 1596 1600 1400 1200 1000 803 800 600
Number of vendors of Number 400 294 200 37 14 0 < $1000 < $10,000 < $50,000 < $100,000 < $300,000 Estimated revenues
Soska and Christin (2015) reported that about 70 per cent of all vendors never managed to sell more than $1,000 worth of products between September 2013 and January 2015. Another 18 per cent of sellers were
59 RAND Europe Internet-facilitated drugs trade observed to sell between $1,000 and $10,000 but only about 2 per cent of vendors managed to sell more than $100,000 over this period of 17 months. Court documents from the United States suggest (Department of Justice 2013) that the revenues of the arrested ‘Dutch vendor’ ‘SuperTrips’, one of the best-selling vendors on Silk Road, were 385,000 bitcoins between January 2011 and October 2013, which would be an average of about 11,300 bitcoins per month. This is considerably more than the most successful vendor in our data for January 2016.38
4.8.5. New developments
We found evidence that some vendors may be using cryptomarkets as ‘convergence settings’. This means that vendors could use cryptomarkets to publicize their illicit activities but use other virtual or offline locations to carry out transactions. Vendors and buyers could, for example, discuss a possible sale through encrypted emails or instant messaging after first meeting via the marketplace, but then arrange the transaction outside of the cryptomarkets. The buyer would therefore not be protected by the escrow services and the cryptomarket administrators but be offered a cheaper price as the vendor does not have to pay a sales commission. LE1 also claimed that wholesale vendors increasingly approach other (retail) vendors through private messages on dark web to offer supply. We tested these observations by coding 368 listings as having titles and descriptions designed obviously and specifically only to generate offline contact rather than sales via the marketplace. Listing prices for these were typically $1. These listings were held by only a handful of vendors. Examples include: • ‘Ketamine, Ecstasy, Cocaine, Crystal, Meths, MDMA, Heroine, MDPV, Marijuana. Email: [email protected] SMS at (xxx) xxx-xxxx’. • ‘GET pain MEDS, Anxiety pills, weight loss pills, Sex pills and others. Email: [email protected] Text at (xxx) xxx-xxxx’.
However, even those vendors using listings to generate sales (with one product listed at a viable price), could be using cryptomarkets to generate contacts in order to transact outside the marketplace. One clue to this possibility is provided through vendors giving email or phone number information in the listing to invite customers to make direct contact. One reading of this provision of external-to-marketplace contact information is that vendors are inviting potential customers to make enquiries. However, the marketplace itself already offers this facility through the private messaging systems all marketplaces have, and offering publicly viewable additional contact information carries additional risks for vendors. It is possible that vendors might take such a strategy specifically to encourage external-to-marketplace transactions, although of course we cannot be certain this is the case. These data are indicative at least of the possibility.
38 When calculating the revenues in US Dollars or Euros, it is important however, to take the historic exchange rate of Bitcoins into account, which in early 2011 was still less than a Dollar. In October 2013, the value of a Bitcoin had already increased to more than 100 Dollars.
60 Internet-facilitated drugs trade RAND Europe
Table 4.20. Prevalence of email information in listings
Country Number of listings with emails % USA 5,782 32% Netherlands 2,127 32% UK 2,021 19% Canada 1,573 53% China 1,486 51% Australia 1,469 44% Germany 1,374 26% India 542 46% Afghanistan 213 42%
Unknown 476 10%
There was email/IM contact information associated with 28,436 listings (27 per cent) and 801 vendors (21 per cent) across all cryptomarkets. Listings from China and Canada had email addresses associated to them over 50 per cent of the time. The listings from the Netherlands had email addresses associated to them about a third of the time, a level similar to that of the United States. These findings do not suggest that all cryptomarket vendors provide extra-marketplace contact avenues and then actually use these to communicate with buyers. They are, however, indicative of a willingness to open communication channels that cannot be monitored simply by monitoring the cryptomarkets themselves. That is, cryptomarkets may generate sales that are not processed via the marketplace.
4.9. In sum
We found evidence of a substantial growth in cryptomarkets since the closure of the first major drug cryptomarket, Silk Road 1.0, in September 2013. The number of listings for drugs has seen a nearly six- fold increase; the numbers of vendors and transactions have nearly tripled; and revenue (aka ‘turnover’) has doubled over the period. As was discussed in Section 2.3, these revenue estimates likely underestimate the true extent of revenues generated on cryptomarkets. Indeed, our DATACRYPTO tool only captured about 80 per cent of listings and a minority of transactions (likely around 20 per cent) did not lead to public feedbacks. We found that large ‘wholesale’ level transactions remained important for cryptomarkets, generating nearly one quarter of overall revenue in September 2013, and in January 2016. This is an important finding. Cryptomarket trade may have an impact beyond creating a new way for drug users to access a wide range of drugs; we believe it is likely that many cryptomarket customers may be drug dealers sourcing stock intended for offline distribution. Cryptomarkets may therefore continue to be diffusing a wide range of substances into local offline drug markets. For clear net markets, there were some indications that online purchasing of NPS in wholesale quantities for the purpose of retail or social supply.
61 RAND Europe Internet-facilitated drugs trade
Trends in relation to the types of drugs sold on cryptomarkets and their relative importance as assessed by sales (transactions and revenues) showed continuity over the assessed period. The key drug categories remained cannabis and ecstasy-type drugs – with stimulants taking on increasing market share (perhaps in part due to increasing numbers of these coming onto the market in the form of NPS) and psychedelic drugs a correspondingly lower market share. Prescription drug sales remained numerous and important (made up mostly of benzodiazepines and opioid medications), but non-prescription opioids (mostly heroin) remained fairly small in terms of overall trade. Vendors likely to be based in the Netherlands showed clear patterns of specialisation, with three quarters of all revenue generated in two drug categories: ecstasy-type drugs (accounting for nearly half of all revenue for these vendors) and stimulants (another quarter). At the wholesale level, this specialisation becomes even greater, with these two drug categories accounting for 82 per cent of all wholesale revenue for ‘Dutch vendors’. This specialism likely reflects the Netherlands’ role in the production of these drug types, making vendor access to these substances relatively easy and also profitable given location in the supply chain. Listings for drug-related products (paraphernalia, equipment, precursors, guides) were sold on cryptomarkets, but generated minimal revenue; ‘Dutch vendors’ appeared to have little if any involvement. Cryptomarkets remained dominated by drug sales, and vendors tended to specialise in drugs, with some also selling drug related products. Only about one in three vendors sold non-drug products and services, and these vendors did not tend to sell drugs as well. In comparison to the understanding we generated about mostly illegal drug sales on the hidden web, we were unable to learn as much about the undoubtedly growing clear net sales of legal substances. The research literature here is comparatively limited (in spite of the fact that these markets have existed for longer than cryptomarkets), likely in part due to the fact that the data that can be obtained via digital trace methodologies deployed on the clear net tell us only about substances listed for sale there and their prices, and not the extent to which sales occur. Nevertheless, we conclude from our analysis that there has been a growth in the availability of NPS through online web shops in Europe.
62 5. Shipping routes
Cryptomarkets are international platforms where vendors from anywhere in the world can put up listings for products that will be shipped to anywhere in the world. Cryptomarkets therefore hold the potential of breaking down national barriers and to facilitate the drugs trade at an international level. An important question is whether the Internet facilitates important trafficking routes in addition to offline trade. Or is it primarily a mechanism to facilitate the domestic distribution of drugs? This chapter primarily focuses on the international nature of cryptomarkets and more precisely on the shipping routes that drugs sold on cryptomarkets take (research questions’ cluster C, and partially D, see Table 1.1). We analyse the main countries from which vendors operate and where they are willing to shop to. Special attention is paid to the role of the Netherlands in these shipping routes.
5.1. Country of origin of drugs traded and vendors operating from the Netherlands
Our analyses are based in parts on the vendor-specified ‘shipping from’ and ‘shipping to’ data point collected by DATACRYPTO as well as interviews with experts and law enforcement officials and data collected from our literature review. Chapter 2 presented in details the limits of using information supplied by vendors given that no verification is made by cryptomarkets to validate it39. The ‘ship from’ and ‘ship to’ data from cryptomarkets should be analysed critically. This section first presents statistics on the number of vendors, the revenues per month and per vendor for each country where at least one vendor is active (Section 5.1.1). These analyses suggests that the Netherlands play a prominent role among all the countries involved in the drugs trade facilitated by the Internet. Moreover, ‘Dutch vendors’ appeared to specialise in specific substances (Section 5.1.2). Interviews and the literature review provide more evidence for this role and on countries of operation on the clear net (Section 5.1.4). Listing descriptions were analysed to determine whether vendors operating from the Netherlands are presenting themselves from other countries (Section 5.1.4). To do so, an analysis of the listings that mention the Netherlands is presented. The possible destinations of listings are
39 Vendors could either say their products shipped from a country and then ship them from another or could physically cross a border to ship their drugs from another country. It is doubtful that the former strategy will be commonly used by vendors. Indeed, customers who believe they are purchasing drugs from a Dutch vendor are likely to report it through feedback, if the product was not shipped from the Netherlands. This may harm the vendor’s feedback scores and therefore reputation.
63 RAND Europe Internet-facilitated drugs trade presented with an analysis of the revenues and number of transactions for the regions where vendors are willing to ‘ship to’.
5.1.1. Country of operation of vendors on cryptomarkets
Only a few studies identified in the literature review commented on the (reported) country of operation of vendors on cryptomarkets (Aldridge & Décary-Hétu 2016a; Bartlett 2015; Christin 2013; Dolliver 2015; Dolliver & Kenney 2016; Phelps & Watt 2014). The results from those studies confirm the prominent role of the United States and United Kingdom followed by several countries, including the Netherlands. Christin (2013), for example, found that the top five ‘most frequent shipping origin’ on listings on Silk Road 1.0 were: United States (43.83 per cent); undeclared (16.29 per cent); UK (10.15 per cent), the Netherlands (6.52 per cent) and Canada (5.89 per cent) (p. 5). Our results suggest that, since these first published studies, Australian vendors have gained foothold on cryptomarkets, as Australia did not feature among the top vendor countries in those earlier publications. Table 5.1 presents further information on the distribution of vendors, transactions and revenues on all eight cryptomarkets.
Table 5.1. Countries from which drug vendors operate: vendors, transactions and revenue
Number of Transactions in Revenues in last month Monthly revenue (per vendor) vendors last month Amount Share USA 890 28,883 $5,099,153 35.9% $5,729 UK 338 20,748 $2,286,196 16.1% $6,763 Australia 185 6,268 $1,501,497 10.6% $8,116 Germany 225 11,039 $1,189,337 8.4% $5,285 Netherlands 225 7,536 $1,104,063 7.8% $4,906 Canada 146 3,007 $1,012,883 7.1% $6,937 France 68 2,051 $242,836 1.7% $3,571 Spain 30 385 $130,520 0.9% $4,350
Multiple 775 9,079 $1,183,238 8.3% $1,526 Unknown 265 868 $41,997 0.3% $158
Others a 287 868 $399,324 2.8% $1,391 NOTE: a All remaining countries (N = 50) were combined. Out of the 3,846 vendors active in any of the eight cryptomarkets analysed, we found 225 vendors that ‘ship from’ the Netherlands on at least one of their listings (these vendors indicated other shipping locations on other listings). Those shipping from the USA were most numerous (890), followed by UK (338), Germany (225) and Australia (185) (a ranking confirmed by LE15). Overall, ‘Dutch vendors‘ accounted for 7.8 per cent of total drug revenues from the eight markets monitored (9.1 per cent if prescription drugs and alcohol/tobacco were excluded). This makes the Netherlands the fifth largest ‘vendor country’ by revenues, after the United States (35.9 per cent), United Kingdom (16.1 per cent),
64 Internet-facilitated drugs trade RAND Europe
Australia (10.6 per cent) and Germany (8.4 per cent). Listings with no ‘ship from’ mention or ‘ship from’ that indicated regions (e.g. ‘Europe’) represent 8.6 per cent of all drug revenues. We found, based on the monthly revenues per vendor measure, the largest revenues were for cryptomarket vendors shipping from Australia, perhaps unsurprising given the disproportionately high street price for illegal drugs there compared to other countries (Van Buskirket al. 2013), a point also noted by an interviewee (LE1). Canada, the UK, the USA, Germany and the Netherlands followed in descending order of revenues. In all cases, the revenues generated appeared fairly large (in absolute terms) and presented significant revenue for individuals though, once again, these were gross revenues and not profits. With regard to wholesale revenue generation (>$1,000) on Silk Road 1.0 (September 2013), Aldridge and Décary-Hétu (2016a) found that countries with the highest share of listings priced over $1,000 were: China (46 per cent), Belgium (20 per cent), Canada (15 per cent) and the Netherlands (12 per cent). Finally, Dolliver’s analysis of Silk Road 2.0 concluded that for drug items, vendors mainly indicated to ship from the USA (26%), Germany (14 per cent), UK (13.8 per cent) and Australia (13 per cent). Vendors from the Netherlands represented 6 per cent. Drug revenues from each country are likely to fluctuate depending on the domestic expenditures on drugs. With its large population, the United States is more likely to have a correspondingly large vendor population and hence higher overall drug revenues. The Netherlands appears to have a substantial concentration of cryptomarket vendor activity is (13.4 vendors per million population) in comparison to the United States (2.8 vendors per million population) and the United Kingdom (5.3 vendors per million population) for instance (see Table 5.1). This revenue analysis demonstrated that sales are dominated by vendors in North America, Europe and Australia, even though vendors operated from dozens of other countries. These high-income countries are likely also to have better access to computers and the Internet, providing them with an edge for participating in cryptomarkets as vendors over smaller and poorer countries. Another explanation for the relatively large share of countries like the United States and United Kingdom may lie in their home consumer markets. It may be that both customers and vendors may prefer to reduce their risks (such as parcel loss, interception by authorities or arrest) by selling or purchasing that involves shipping only within their country of residence (Décary-Hétu et al. forthcoming). Interviewees (EX12) also noted that buyers may prefer to communicate in their native language and domestic buyers may improve perceived customer fidelity. LE7 reported that France, for instance, has a relatively large domestic market for drugs sales via cryptomarkets. Referring to Silk Road, Christin (2013) noted that this is not surprising since all communications are in English. Although since then several non-English language markets have appeared40, English remains the dominant language. This may be a consequence of the dominant position of Anglo-Saxon countries in Internet-facilitated drugs trade. But English, as the Internet’s lingua franca, may also act as an entry barrier to cryptomarkets for non-English speaking vendors.
40 For instance: Finnish (Silkitie), Russian (Ramp, RuTor, Russian Silk Road), French Dark Net (French Dark Net), and Italian (IDC)
65 RAND Europe Internet-facilitated drugs trade
5.1.2. Vendors’ country of operation and substance types
Data presented in Chapter 4 confirmed that ‘Dutch vendors’ tend to have a very large share in global ecstasy-type drug (including MDMA) revenues (23.3 per cent) on the eight cryptomarkets analysed. Ecstasy made up almost half of all drugs revenues by ‘Dutch vendors’ on these cryptomarkets. Experts confirmed an image of the Netherlands as one of the prime suppliers of ecstasy on cryptomarkets (LE2, LE9, LE15, EX3, EX4). The large share of MDMA ecstasy by ‘Dutch vendors’ seems to be driven by the earlier mentioned dominant role of the Netherlands in its production. Interviewees sketched a picture where ecstasy vendors either have their own production facilities, mostly in the province of Noord-Brabant, or have close ties to producers (Focus Group, LE1, LE7). International price differences make it attractive to sell these pills to buyers abroad (EX12). An ecstasy pill in Australia may cost AUS$35 (ca. €23) compared to only €1.50 in the Netherlands (LE1). Many interviewees also mentioned the dominant role of ‘Dutch vendors’ in cannabis trade on cryptomarkets (LE2; LE9; EX3). Kooistra and Trommelen (2014) estimated that 27.5 per cent of revenues for ‘Dutch vendors’ is generated by herbal cannabis and 16.4 per cent by cannabis resin. LE2 argued that online cannabis sales by ‘Dutch vendors’ is driven by Netherlands’ position in the international cannabis trade, which (s)he argues, is linked to its coffeeshop policy. It may be lucrative for a producer or wholesale dealer to sell online in addition to his supply to coffeeshops. Law enforcement representatives (e.g. LE2) had reasons to believe that large cannabis vendors are geographically close to production and wholesale, because of the quantities they sell. Our data, however, suggested that ‘Dutch vendors’ only account for 2.3 per cent of the total cannabis revenues from the eight markets (see Table 4.3), a share that is much lower than their total market share of 7.8 per cent across all substances. This was echoed by LE1, who noted that only few ‘Dutch vendors’ are involved in selling cannabis online. Table 4.3 shows that ‘Dutch vendors’ tend to generate more revenues from stimulants (including cocaine) and psychedelics. Indeed, interviewees also noted the prominence of ‘Dutch vendors’ in the sales of ketamine, C2B, LSD, speed and cocaine (LE1, LE2, LE7, LE9). According to LE2, sales of ketamine, for instance, which is relatively easily available in the Netherlands, is only recently becoming more popular among ‘Dutch vendors’.
5.1.3. Potential biases in the vendor countries
Various interviewees indicated that the Netherlands is increasingly on the radar of borders officials in other countries, with Australian borders officials reportedly screening 100 per cent of packages coming into the country from the Netherlands. It is likely that other countries have policies of increasing vigilence for packages coming in to their countries from the Netherlands (LE1, LE9, LE11, EX4). ‘Dutch vendors’ may respond by sending packages via intermediaries in other countries, or by travelling to neighbouring countries to make these shipments themselves, endeavouring to keep their shipments under the radar. In particular, law enforcement interviewees (e.g. LE1, LE9, EX3, Focus Group) mentioned that various ‘Dutch vendors’, or their aides, travel to Germany to post packages. A recent arrest of a ‘Dutch vendor’ planning to post a hundred packages totalling 100,000 ecstasy pills in Germany (NOS 2016a) seems to confirm this practice.
66 Internet-facilitated drugs trade RAND Europe
We were able to find some empirical evidence for this practice. To investigate this, we examined all listings not indicating they ‘shipped from’ the Netherlands and searched their product descriptions for mention of the following words: Dutch, Netherlands, Holland, NL and NLD. We found that, among drug listings using one or more of these words, 4,464 (8.3 per cent) were associated to non-‘Dutch vendors’.41 There could be a range of reasons for mentioning these words. As one example, ‘Dutch’ is considered a quality indicator for MDMA, and so (say) a German vendor might then refer to ‘Dutch quality’ MDMA. However, some of these vendors indicating that they ‘ship from’ countries other than the Netherlands might actually be ‘Dutch vendors’ who do, in fact, ship from other countries. The fact that a predominance of these listings mentioning ‘Dutch’ and variants resided in countries neighbouring or nearby countries (Belgium, Germany, France and the UK) is further suggestive of this possibility. Table 5.1 shows that a large proportion of vendors on these marketplaces did not indicate one single ‘shipping from’ country from which products would be shipped, but instead indicated larger areas (e.g. ‘Europe’). This is indicated as Multiple in this table. Vendors may also obfuscate this information in other ways such that we were unable to identify a single country. This is indicated as Unknown in the table. Vendors obfuscating their country of operation did not appear to prevent sales completely. However, they did generate the lowest monthly revenue on a per-vendor basis, compared to vendors that indicated the country from which products would be shipped.
5.1.4. Country of operation for vendors on the clear net
Previous chapters explained that drugs trade facilitated by the clear net tends to be dominated by NPS. Similarly, a review of the literature found that NPS do not appear to be frequently purchased on cryptomarkets (Stephenson & Richardson 2014). In terms of non-controlled NPS, Stephenson and Richardson (2014) stated that there is little advantage for users to use cryptomarkets when the substances are easily available on the clear net. Schmidt et al. (2011) found 39 online shops in the United Kingdom in 2009, and research by Bigdeli et al. (2013) identified 51 Persian language websites aimed at ‘NPS purchase’ between 2011–2012 (p. 512). Authors reporting on the I-TREND project (Martinez et al. 2016) found that in May 2014, most online shops selling NPS were from the United Kingdom (207) and Poland (72). Some 19 shops were identified to be operating from the Netherlands (Table 5.2). EX3 echoed that sales of NPS do not seem to play an important role in the Netherlands.42 The interviewee argued that this may be due to the relatively developed market for illicit substances in the Netherlands, where stimulants, psychedelics and ecstasy-type drugs are relatively cheap and easily available. In other countries the drug market is different and disrupted, which might lead to ‘people to NPS’ (EX3).
41 i.e. vendors who indicated they are shipping from countries other than the Netherlands. 42 There is one exception: 4-FA. As reported in the media, this particular NPS is gaining popularity in the Netherlands and is purchased online as well as offline. For recent media coverage, see NOS (2016b).
67 RAND Europe Internet-facilitated drugs trade
Table 5.2. Number of online shops selling NPS
CZ FR NL PL UK Total
Number of shops identified between 33 112 27 103 309 584 November 2013 and May 2014
Number of active shops remaining in May 30 64 19 72 207 329 2014a
Share of: Commercial/Branded shops 13% 28% 26% 17% 19%
…Herbal shops 43% 28% 11% 1% 2%
…Research Chemical shops 43% 33% 63% 82% 76%
…Other 0% 11% 0% 0% 2%
Active online shops by IP location in May 2014
…Czech Republic 42% 1% 0% 7% 2%
…Germany 0% 11% 4% 8% 7%
…Netherlands 6% 38% 52% 6% 4%
…Poland 3% 1% 0% 48% 1%
…United Kingdom 6% 4% 11% 2% 14%
…United States 18% 24% 19% 16% 44%
…Other 24% 21% 15% 15% 29%
NOTE: a With duplicates removed. New online shops collected in November 2014 have not been included in this table. SOURCE: Martinez et al. 2016, 101-102.
I-TREND also investigated the online shops’ IP addresses, which did not always concur with the country of the targeted consumer market. The authors found that ‘the unique sales sites intended for the Czech, Dutch and Polish markets are more likely to be locally based (CZ, 42%; NL, 52%; PL, 48%) than those intended for, for example, France, where sites are often located in the Netherlands (38%) and the United States (24%). This is also the case for the United Kingdom (44% located in the United States)’ (Martinez et al. 2016, 102). These results suggested that approximately 50 out of 392 active shops identified had their physical presence in the Netherlands. It should be noted that thus far most research efforts have focused on the western world. This is partly because NPS use has been seen as primarily a Western phenomenon (Mahapatra and Sharma 2016). There is little reliable data available on the consumption, sales or distribution of NPS in other parts of the world. However, as production of NPS is often linked to Asian countries such as China, Malaysia, the Philippines, India and Pakistan (EMCDDA 2016a; APAIC 2016; Dargan and Wood 2012; UNODC 2015), Mahapatra and Sharma (2016) argue that Asian countries could provide a fertile ground for
68 Internet-facilitated drugs trade RAND Europe consumption as well. They therefore advocate the extension of the snapshot methodology to Asia with the aim of exploring and monitoring the online market of NPS amongst Asian population.
5.2. Data on demand side of Internet-facilitated drugs trade
In this section, we analyse the most common shipping routes, suggesting that domestic sales play an important role in cryptomarkets (Section 5.2.1). While DATACRYPTO does not provide any information on the cryptomarket buyer population, the literature review will provide some clues on the size and scope of this population (Section 5.2.2). Data scraped from cryptomarkets only tell us something about the ‘supply side’. Information about the location of customers making purchases was not available. The cryptomarket analysis was able to identify the willingness of vendors to ship to particular countries, which may provide an insight into the demand side. There have, however, been some studies looking at the buyer population (both for cryptomarkets and the clear net) that may complement the supply side data (see Table 5.5). Of these studies, only one used a nationally representative sample (the Crime Survey for England and Wales) and found that 1 per cent of those aged 16 to 59 having used drugs bought these drugs online. The following sections describe vendors’ willingness to ship to other countries and data on the size of the buyer population respectively.
5.2.1. Willingness to ship to other countries
Success rates, associated feedback and customer ratings are of crucial importance for the success of vendors’ businesses (Cox 2016a). Therefore, they sometimes avoid shipping to countries where the (perceived) risk of interception is relatively high (LE2). The introduction of stringent scanning in Australia of all incoming parcels from the Netherlands, for instance, has caused many ‘Dutch vendors’ to refrain from serving customers in Australia (LE1, LE9), but the United States, Canada and Finland have also been mentioned as countries where stringent scanning practices have been introduced (LE11). Using such ‘willingness to ship to’ information in our analysis of cryptomarket data allowed us to offer some indication of the demand side. Table 5.3 includes only vendors willing to ship to the region indicated. As such, we know all sales associated to these vendors will be in relation to sales to these countries and regions. This table includes information relating to less than half of the total vendors across the eight markets, since many vendors were willing to ship to multiple or unknown regions (shown as Unknown in the table). The picture painted here may therefore be misleading; those shipping across multiple regions (e.g. ‘Worldwide’, for example) may draw on a differently distributed – in geographical terms – customer base. We were thus limited in our ability to identify where all products are actually shipped. Many vendors are willing to ship to the United States, making it the destination with the highest revenues (over $4m). This is not surprising given that many vendors operate from that region.
69 RAND Europe Internet-facilitated drugs trade
Table 5.3. Distribution of transactions and revenues across regions shipped to (All drug listings)
Number of vendors Transactions in last month Revenues in last month USA 717 24,058 $4,292,975 Oceania 192 6,016 $1,460,901 Northern Europe 195 5,470 $499,741 Western Europe 91 2,244 $272,430 Canada 22 155 $16,225 Southern Europe 6 1 $132 Eastern Europe 3 2 $86 Middle East 1 0 $0 Nothern Europe 1 0 $0 South America 1 0 $0 South-Eastern Asia 1 0 $0 Unknown 1,840 55,493 $7,648,553 Total 93,439 $14,191,043
Oceania (Australia and New Zealand) has been shown in the literature to be a very active place for cryptomarkets and Table 5.3demonstrates that vendors willing to ship to its countries (Australia, New Zealand) generated over 6,000 transactions and almost $1.5, in revenues. Europe is also a very popular destination for cryptomarket vendors to indicate they are willing to ship products. Vendors willing to ship to Western and Northern Europe rank in third and fourth place with combined revenues that represent half of Oceania.
Table 5.4. Most common shipping routes on cryptomarkets (All drug listings)
Number of Monthly Shipping route Number of listings transactions revenues North America => North America 11,859 25,908 $4,944,125 Europe => Europe 8,901 20,543 $2,213,464 Oceania => Oceania 2,639 6,003 $1,452,546 Asia => North America 117 31 $13,127 North America => Oceania 16 7 $6,888 Africa => Europe 15 8 $1,218 Europe => North America 14 7 $933 South America => North America 3 5 $670 Asia => Europe 9 2 $16 Asia => Asia 11 1 $12 Routes with no revenues 25 0 $0 Incomplete routes 27,177 34,783 $4,805,614 Unknown origin and destination 9,551 6,143 $752,430
70 Internet-facilitated drugs trade RAND Europe
Table 5.4 presents another perspective on the route that drugs may take through cryptomarkets. Here again, we only have access to partial information as many vendors did not indicate where they shipped from and/or where they were willing to ship to. Still, our results indicate that the most common shipping route was from and to North America (almost $5m in revenues). These shipping routes were likely composed of mostly American vendors selling domestically to customers in the United States. The second most important route, based on the available data, goes from Europe to Europe with over $2m in revenues. The three most important routes all indicated that the shipments stayed in the same continent, perhaps to limit the risks of interception and inspection. All other shipping routes provided negligible transactions and revenues. Our data show that most listings had at least some information about ‘shipping to’ or ‘shipping from’. The incomplete routes are missing either the origin or the destination of the drug, which could still provide some information on the shipping route used for the drugs. We are only missing information on 5 per cent ($752,430) of the revenues. Unfortunately, we could only find 7 listings that shipped explicitly to the Netherlands. While there are undeniably many transactions from customers in the Netherlands, our DATACRYPTO sample is unable to provide us with any information regarding them. The 7 listings are offering MDMA, speed and hash and are advertised on 3 markets by 3 different vendors. The lion’s share of revenues for ‘Dutch listings’ are shipping to Europe, generating over $235,000. A very small minority shipped to North America. Here again however, the vast majority of shipping routes are unknown and this result must therefore be interpreted with caution.
5.2.2. Estimating the size of the buyer population
There was limited information available on the size of the buyer population, both for the cryptomarkets and the clear net. Anecdotal comments in the literature on buyers on Silk Road 1.0 referred to 30,000 to 150,000 active customers (date not specified, Christin 2013), with reportedly 147,000 active buyer accounts in July 2013 (Maddox et al. 2016). Only one study, the Crime Survey for England and Wales Crime Survey for England and Wales, was based on a nationally representative sample and found that 1 per cent of 16 to 59 year olds that used drugs (unspecified) bought them online (‘online’ not further specified). In comparison, almost 60 per cent obtained them from someone well-known (other than family members). There was limited information for the Dutch buyer population specifically. Where information was available, estimating the size of the total buyer population was mainly not the primary goal of the studies identified, yet was included in a subset of questions, or was only estimated for a particular type of drugs or group of buyers. As such, based on the information provided in these studies, a full picture of the size of the buyer population could not be provided. Examples of the relevant studies identified are included in Table 5.5. Given the limited number of studies and the fact that for most of the studies ‘internet’ is not further specified, cryptomarket and clear net data are presented in one table. Where applicable, (indications of) the size of the Dutch buyer population is indicated in bold.
71 RAND Europe Internet-facilitated drugs trade
Based on findings of some of the studies outlined in Table 5.5, the sale of NPS might take place predominantly offline, rather than on the internet (Advisory Council on the Misuse of Drugs 2011; The Gallup Organisation 2011; Stephenson & Richardson 2014; The New Psychoactive Substances Review Expert Panel 2014; Van Amsterdam 2015).43 For instance, a study involving qualitative interviews with 25 experienced drug users in the Netherlands found that NPS were mainly obtained through friends, with seven users indicating that they sometimes ordered NPS through internet websites, and two reported purchasing NPS from a trusted dealer (Van Amsterdam 2015). Users would share information about websites offering NPS or introduce friends to a dealer (Van Amsterdam 2015). In addition, the Flash Eurobarometer Number 330 on youth attitudes to drugs found that of nearly 600 respondents in 27 EU countries, only 7.3 per cent of those who had used NPS purchased the substances on the internet (The Gallup Organization 2011). Similarly, the Flash Barometer Number 401 on young people and drugs found that only 3 per cent of NPS users across 28 EU countries bought the substances on the internet (TNS Political and Social, 2014). In both surveys, none of the Dutch respondents indicated to have bought NPS online.
Table 5.5. Examples of studies that commented on or had details related to the size of the buyer 44 population
Study details (survey Key findings title provided if applicable)
Antenne 2014 Findings from a 2014 survey conducted among visitors of bars in Amsterdam showed that (Benschop et al. of those who recently used GHB (n = 49), 4.1% bought GHB on the internet (‘internet’ 2015). not further specified), compared to just under 40% who obtained GHB from a dealer. Report None of the respondents who recently used ecstasy (n = 262), cocaine (n = 150), amphetamine (n = 102) bought these substances online.
Van Buskirk et al. Findings from interviews with a purposive sample of 745 participants - that regularly used (2016) drugs - of the Australian ‘Ecstasy and related Drugs Reporting System’ in 2014 showed that Academic paper 12% ever bought drugs on the dark net.
Van Amsterdam et al. Interviews with 25 experienced recreational drug users in the Netherlands in 2012 found (2015). that they mostly obtained NPS through friends, with seven drug users indicating to have Academic paper bought them sometimes via the internet (‘internet’ not further specified).
Table continues on next page
43 Based on the context in which the information was reported, it is likely that the sources referred to the clear net. 44 The authors are aware of annual surveys conducted in Spain (EDADES, ETUDES, Early Warning System) and Hungary (National Focal Point) that include questions on online drug purchases, yet given language constraints these are not discussed here (Trautmann, 2016).
72 Internet-facilitated drugs trade RAND Europe
Table 5.5. Examples of studies that commented on or had details related to the size of the buyer population (continued)
Study details (survey Key findings title provided if applicable)
Global Drugs Survey Recent findings of the 2015 Global Drugs Survey, as conducted in 2014 and with over a (Barratt et al. 2014; 100,000 responses (non-representative sample), showed that 3.8% of Dutch respondents GDS 2015). purchased drugs on the dark net over the past 12 months. Academic paper; Barratt et al. (2014) reported on findings of the annual online Global Drugs Survey as website conducted in 2012/2013. The authors looked at a purposive sample (non-representative) of 9,470 respondents from Australia, the United Kingdom or the United States or who used the currencies from those countries, who ‘indicated that they usually bought their own amphetamine, cannabis, cocaine, 3,4-methylenedioxy-N-methylamphetamine (MDMA), ketamine or mephedrone, or who reported buying ‘legal highs’/‘research chemicals’ or any drugs online during the last 12 months’ (p. 775). It was found that 18% of the US respondents, 10% of the UK respondents and 7% of the Australian respondents bought their drugs on Silk Road. The most commonly obtained drug from Silk Road across the three countries was MDMA (53-60%).
Flash Eurobarometer In 2011, out of a sample of 597 young people from 27 Member States who indicated to on youth attitudes on have used NPS, 7.3% indicated to have bought NPS on the internet (‘internet’ not further drugs (The Gallup specified). In comparison, over half of the sample obtained NPS through friends (54.2%). Organization 2011; None of the respondents in the Dutch sample (n = 17) indicated to have bought NPS TNS Political and online. Social 2014). In 2014, 3% of young people from 28 Member States who indicated having used NPS in Both reports the past 12 months bought these substances over the internet (sample not provided and (‘internet’ not further specified). 68% received or bought NPS from a friend. None of the respondents in the Dutch sample (sample size not provided) indicated to have bought NPS online.
Crime Survey for In 2013, 1% of people from England and Wales aged 16 to 59 who indicated to have England and Wales used drugs (not further specified) in the past 12 months bought their drugs online (‘online’ (Home Office, 2014). not further specified). In comparison, 57% obtained them from someone well known (not Report being a family member). The survey is based on a nationally representative sample.
Gonzalez et al. Findings from a cross-sectional survey carried out at music festivals, NGOs and a drug (2013). forum among 230 Spanish research chemical (RC) users in 2010 and 2011 found that Academic paper 74.5% of the sample of RC users consulting drug forums (n = 112) acquired RC through the internet (‘internet’ not further specified). This was 25.5% for the sample of those not consulting drug forums for information about RC (n = 118).
Gordon et al. (2006). Semi-structured interviews conducted between 2003 and 2004 among 100 ‘adult drug- Academic paper dependent inpatients in a private residential treatment program’ (p. 271) in Pennsylvania (United States) found that eleven people obtained their drugs or found a drug dealer through the internet (‘internet’ and ‘drugs’ not further specified). Of this group, nine actually bought drugs online, with two having found a dealer through chat rooms.
5.3. In sum
Cryptomarket vendors have set up listings that appear to be shipping from dozens of countries. Based on drug revenue generation, the United States was the most prominent country with 36 per cent of all drug revenues going to vendors who advertise shipping from it. The distribution of revenues across countries has not changed much over the past years to the exception of Australia who has seen its share of revenues
73 RAND Europe Internet-facilitated drugs trade increase over the past three years. ‘Dutch vendors’ accounted for 7.8 per cent of all drug revenues, the fifth largest country. Few drug listings hid the country they ship from. Listings shipping from regions (e.g. from Europe) or from unknown countries only represented about $1,200,000 in drug revenues. It is therefore usually possible to determine where drugs are advertised as coming from. When comparing revenues per vendor, those operating from Australia appeared to generate most drug revenues on cryptomarkets. This is in line with the vastly higher prices of drugs in Australia, which probably translates to higher prices per unit. The Netherlands were in sixth place in regards to revenue per vendor but had a much higher ratio of vendors per inhabitant than other countries. Netherlands had for example 4.5 times more vendors per capita than the United States. The ‘Dutch vendors’ mainly list drugs, particularly MDMA, that can be produced inexpensively domestically and then resold for higher prices in other countries. ‘Dutch vendors’ were also active in the sale of other types of drugs such as ketamine. There was anecdotal evidence that ‘Dutch vendors’ also offer listings that ship from outside the Netherlands. In this case, vendors would drive across a border to ship from neighbouring countries like Germany. There were also indications that vendors use the Netherlands name to increase the perceived quality of their products. Little information could be gleaned from sales of drugs on the clear net. There appeared to be hundreds of web shops in Europe operating from a range of countries, mostly in the United Kingdom and Poland. Only a limited number of shops were operating from the Netherlands. These markets are generating an unknown number of revenue. The United States and Oceania were the two most common destinations for vendors who specify where they are willing to ship to. Europe follows with about $800,000 in drug revenues. All the figures that relate to the destination of drugs were difficult to analyse since more than half of all drug revenues have an unknown destination. The most common routes for drugs were domestic United States, domestic Europe and domestic Oceania transactions. Here again, given that incomplete or unknown routes accounted for more than a third of all drug revenues, it was difficult to precisely estimate the share of drug shipping routes. We could find little evidence of the demand side for drugs in the Netherlands. Almost no listings were posted by ‘Dutch vendors’ that targeted only customers in the Netherlands. The limited number of studies that reported on consumers buying drugs online found little to no evidence that Dutch customers were using the Internet to buy drugs.
74
6. Actors involved in Internet-facilitated drugs trade
In addition to estimating the size of online drug markets, the WODC requested a characterisation of the different actors involved in these markets, to feed into the broader understanding of Internet-facilitated drugs trade. As such, this section presents an overview of the actors involved in Internet-facilitated drugs trade, including their characteristics (age, gender, previous involvement in drug use or trade, etc.) and motives (research questions’ cluster D, see Table 1.1). In addition to some general descriptions for various roles, two key actors, vendors and buyers, will be described in more detail in subsequent sections since more details on these actors were provided in previous studies and interviews. This chapter primarily presents an overview of findings from the literature and is complemented by interview and case file data. The findings, however, mainly relate to cryptomarkets as evidence for the clear net was limited. Several studies identified in our literature review commented on the different actors involved in the trade of drugs on the Internet, although it should be noted that these studies were not all based on primary, empirical data, but also included references to other studies that focused on these actors. Furthermore, most of the studies that reported on characteristics and modus operandi of these actors were based on small sample sizes and focused on specific cryptomarkets or countries. Additionally, a limitation of collecting primary data from actors on online marketplaces relates to self-reporting bias, as those consenting to interviews or other forms of data collection may be the ones that are most positive or negative, for example. Following the above, the findings presented in this chapter are not representative of all actors on online marketplaces.
6.1. Overview of actors involved in Internet-facilitated drugs trade
Based on the literature and case file analysis, five key actors involved in Internet-facilitated drugs trade on cryptomarkets were identified.45
• Administrator. According to Martin (2014a), the administrator sits ‘at the top of the cryptomarket hierarchy’ (also confirmed in the current study’s case file analysis) and within this role has ‘full access to the cryptomarket’ (p. 18). The administrator has an executive and managing role on the marketplace, is responsible for the policies on the marketplace and ‘fulfils the role of treasurer with regard to cryptocurrency’ (Van Slobbe 2016, 79; Martin
45 Less detail on actors on clear net markets were identified in the literature and interviews. While vendors and buyers were also mentioned in relation to clear net markets, administrators, developers and moderators were mentioned explicitly for cryptomarkets.
75 RAND Europe Internet-facilitated drugs trade
2014a; LE15).46 Administrators receive a commission for each sale finalised through the marketplace (Christin 2013; Martin 2014a). Several authors pointed to the libertarian ideologies often shared by the actors on these online platforms (Aldridge & Décary-Hétu 2014; Christin 2013; Maddox et al. 2016; Ormsby 2016; Van Hout & Bingham 2014; Van Slobbe 2016). • Developer. Developers are primarily responsible for designing the technical infrastructure on online drug markets. Details found in the case file analysis showed that the developers were all young and IT-skilled males who developed these websites on a freelance basis. • Moderator. Generally speaking cryptomarkets have a number of moderators that will manage different aspects of the site (LE15). As Martin (2014a) states, moderators ‘are ranked below administrators in the cryptomarket hierarchy and assist with lower-level site maintenance and customer support’ (p. 18).47 As such, the moderator has less access to the infrastructure of the marketplace and user information than the administrator (Martin 2014a; Van Slobbe 2016). Moderators could receive a salary from the administrators (Martin 2014a). Some technical aspects require specific skill sets that admins might advertise for – as Tor does not require the individuals to meet directly this work could be managed anonymously (LE15). • Vendor. A vendor sells his or her (illegal) goods to customers through his or her own seller page (Martin 2014a). Details on vendor characteristics will be further explained in Section 6.2. • Buyer. Customers on cryptomarkets and vendor shops purchase goods or services on vendors’ seller pages, could provide feedback on these purchases and may be involved in discussions on forums (Martin 2014a). Characteristics, motives and modus operandi of buyers will be further discussed in Section 6.3.
While the above actors are knowingly involved in online drug markets, previous studies and interviewees identified several other actors that (could) have a supporting role in online drug markets (both cryptomarkets and the clear net) who may not know their services are used for illicit purposes. These actors include bitcoin exchangers, Internet Service Providers, suppliers of legal goods and postal services. Firstly, the conversion between flat currencies and virtual ones or from one virtual currency to another generally takes place via online bitcoin exchangers. Although most of these services are legitimate, they exist as a service within the digital underground economy. Although generally designed for legitimate use to offer security to customers, virtual currencies are taken advantage of by cybercriminals as well (Europol 2014). Secondly, Internet Service Providers offer different services to customers (online drug markets in this case), including Internet access and hosting domain names (Xfinity.com 2016). Lahaie et al. (2013) found
46 Martin (2014) provides a detailed description of the actions that fall under these responsibilities: ‘authorising and suspending individual accounts; overseeing ‘stealth’ transactions not publicly listed (see Christin 2013); creating new product categories; authorising or prohibiting the sale of various items; as well as innovating and implementing new security procedures and cyber-defences’ (p. 18). 47 Responsibilities include: ‘regulating forum discussions; identifying fraudulent activity committed by scammers and responding to requests for assistance and complaints from vendors and consumers’ (Martin 2014a, 18).
76 Internet-facilitated drugs trade RAND Europe that servers hosting online marketplaces selling NPS ‘are located elsewhere in countries where they can escape national regulations and these locations themselves are different from those from where the goods are sent’ (p. 3).48 Lavorgna (2014) similarly found cases of commercial websites being hosted in the Netherlands to escape regulations in countries that had ‘more stringent drug laws’ (p. 262). Thirdly, based on comments from interviewees on stealth packaging practices, suppliers of legal goods, such as envelopes used for stealth packaging, could also (unknowingly) play a role in the online drug market. Finally, drug couriers, legal courier services or mail services also (deliberately or unknowingly) play a role in cryptomarkets given their involvement in delivering the drugs to the buyers’ address (Lavorgna 2014; Raeesi 2015; Tzanetakis et al. 2016).49 Lavorgna (2014) further explained in her article that trusted couriers could be used for recruitment of new couriers: ‘online social networks of trusted couriers are used to recruit new people by dangling the possibility of undertaking profitable “holidays” in exotic destinations’ (p. 252).
6.2. Vendor characteristics and motives
6.2.1. Vendor characteristics
Unsurprisingly, only a limited number of studies reported on characteristics of actors involved in Internet- facilitated drugs trade obtained through primary data collection, and these mainly focused on vendors on the dark net (Buxton & Bingham, 2015; Ormsby 2016; Van Hout & Bingham 2014).50 There were no empirical studies identified that collected primary data on characteristics on vendors or other actors (not including buyers) present on the clear net. There were examples of studies monitoring clear net markets, the NPS market in particular, yet they did not specifically examine the characteristics of the actors involved (e.g. Corazza et al. 2014; Martinez et al. 2016). Van Hout and Bingham (2014) conducted online interviews with vendors (n = 10) on Silk Road, of which the majority were male (n = 9), just over half (n = 6) in the age range 30 to 39, just over half (n = 6) in a form of employment or education and two having attained graduate level education. They characterised themselves as ‘intelligent and responsible’ drug consumers for whom the ‘harm reduction ethos’ of Silk Road was attractive (Van Hout & Bingham 2014, 186). This finding from previous research was supported by data collected in our study: our interviewees also mentioned that common characteristics of vendors were: male, young (sometimes students), intelligent, tech-savvy (e.g. EX3, EX10, LE11, LE15). Similarly, the vendors involved in the police case file reviewed for this study were male, with age ranging from 20 to 50 and some were educated. Interviewees pointed to a mix of countries where vendors primarily seem to operate from the UK, the US, Australia and Germany (EX10, LE15).
48 For this particular comment, Lahaie et al. (2013) do not specify whether they refer to marketplaces on the clear net or dark net. Based on the context of their report, however, it is likely that they refer to the clear net. 49 For clear net market places, the involvement of couriers and postal services is also mentioned in reports (e.g. Buxton & Bingham 2015; EMCDDA and Europol 2013; Vardakou et al. 2011). 50 Information on buyer characteristics is explained in Section 6.3.1.
77 RAND Europe Internet-facilitated drugs trade
Although the dominant language on cryptomarkets is primarily English, some vendors did communicate in their native language. Additionally, Gwern (2016), an independent researcher, has collected information on arrests in relation cryptomarkets dating back to not long after the opening of Silk Road 1.0 in January 2011. Whilst arrests are not representative of the vendor population, they do provide some sparse empirical data on individual characteristics. Table 6.1 shows that of all 127 vendors arrested in relation to cryptomarkets are predominantly male (106 men, 15 women, 6 unknown). Their mean age is 33 years (SD = 10.6).
Table 6.1. Number of arrests by role and age profile for cryptomarkets, excluding non-drugs
Female Male Unknown Total Mean Mean Mean # age Std dev # age Std dev # # age Std dev Buyer 9 33.0 (14.6) 101 24.4 (7.2) 75 185 25.0 8.0 Operator 6 27.5 (2.1) 6 27.5 2.1 Vendor 15 35.6 (13.1) 106 33.1 (10.5) 6 127 33.4 10.8 Staff 1 9 36.2 (12.9) 10 36.2 12.9 (blank) 15 24.0 (6.0) 16 31 24.0 6.0 Total 25 34.625 (13.3) 237 28.4 (9.8) 97 359 28.8 10.2 NOTE: age when arrested; if only a range is known, median was selected. Operator refers to cryptomarket administrator or founder. Staff may include developers and moderators.
SOURCE: as of 12 June 2016: https://www.gwern.net/Black-market%20arrests Furthermore, the geographic distribution of arrestees seems broadly consistent with the scraped ‘shipping from’ cryptomarket data. Most arrested vendors are from Anglo-saxon and Western European countries, with most (35 per cent) from the United States, followed by Sweden (15 per cent), the Netherlands (11 per cent) and the United Kingdom (10 per cent) (Table 6.2).
78 Internet-facilitated drugs trade RAND Europe
Table 6.2. Number of arrests for cryptomarkets by role and country, excluding non-drugs
Buyer Operator Vendor Staff Unknown Total
USA 99 2 44 4 6 155
New Zealand 25 - - - 11 36
Germany 9 - 7 1 12 29
UK 12 - 13 - 2 27
Australia 18 - 5 1 - 24
Sweden - - 19 - 19
Netherlands - 2 14 1 - 17
Austria 6 - 2 - - 8
Ireland - - 7 1 - 8
Canada - - 6 - - 6
India 5 - - - - 5
Norway 1 - 4 - - 5
Other 10 2 6 2 - 20
Total 185 6 127 10 31 359
NOTE: Operator refers to cryptomarket administrator or founder. Staff may include developers and moderators. SOURCE: as of 12 June 2016: https://www.gwern.net/Black-market%20arrests
6.2.2. Vendor motives
In Van Hout and Bingham’s (2014) research, vendors listed several reasons for commencing selling drugs on Silk Road: ‘the lure of vending within an economically viable and secure business channel with high volume of site traffic, educated and wealthy customer base, availability of distinctive ethno-botanicals and synthetic compounds, pricing profits and capacity to circumvent national legislative controls was attractive’ (Van Hout & Bingham, 2014, 188). Ormsby (2016), an investigative journalist, collected stories of hundreds of Silk Road members, including buyers, vendors and staff, through interviews and messages via email and secure forums or chats. The vendors primarily reported to be males in the age range of 20 to 40, who mainly commenced selling drugs online based on a financial motive: ‘personally I am completely financially motivated in what I do … I went through the local Australian listings, did a bit of maths and thought “Wow, these guys are paying ridiculous prices for their drugs, there’s definitely profit to be made here!” said AussieDomesticDrugs, who sold exclusively to Australian and New Zealand buyers’ (Ormsby 2016, 65). Comments on profitability of selling drugs online were also found in our case file analysis and mentioned by some interviewees (EX13, LE1). Bartlett (2015), a journalist who wrote a book on his research into the dark net, came up with a rough annual income estimate based on sales data of nine medium-size vendors on Silk Road 2.0 between January and April 2014, and concluded that the estimate ($60,000–120,000 annually per vendor) suggested that the vendors are ‘more likely middle-
79 RAND Europe Internet-facilitated drugs trade market and retailer dealers’ (chapter 5, page not indicated).51 It should be noted that data collection methods were not transparent in Bartlett’s research as his analysis was based on a data file as posted on a Silk Road forum by an anonymous Silk Road 2.0 user. As such, these findings should be treated cautiously. For the NPS market, Lahaie et al. (2013) referred to the EMCDDA that reported that ‘the market is currently dominated by opportunists who profit from the Internet to promote and sell their products’ (p. 3).52 They further noted, however, that Europol reported that ‘the traffic of NPS is sometimes associated with that of illegal substances suggesting that criminal organisations may be becoming interested in this market’ (p. 3). Ormsby (2016) also found that vendors appreciated the absence of meeting buyers in person, as this was felt as a safer way of doing business. This was also noted by LE9. Vendors indicated that online sales eradicated the potential use of violence, and it gave vendors the option to prioritise the best customers: ‘not only did dealers have to be wary of customers, who might use violence to rob them of their wares, many found that habitual drug users could become irritating when looking for drugs at short notice. They knew their dealers’ addresses and their phone numbers and demanded that they be available day and night. Silk Road provided them with the opportunity to deal with orders at times convenient to them, and to ensure their best customers’ orders were prioritised’ (Ormsby 2016, 65). In their policy brief, Buxton and Bingham (2015) described how a vendor felt safer through selling online: ‘the street market is more risky for everyone. I would not want to sell from my house or my car to people face to face where I can be identified by several ways. Not only by police but by other rival dealers or gangs. The street market doesn’t have feedback or rating available for every buyer to read. You are more likely to be involved with people who might not be concerned in your welfare’ (pp. 10–11). Anecdotal comments as found through our case file review, however, also pointed to preferences for selling drugs offline, since fees are applied when selling drugs online. Finally, several authors pointed to the libertarian ideologies often shared by the actors, not just vendors, on these online platforms (Aldridge & Décary-Hétu 2014; Christin 2013; Maddox et al. 2016; Ormsby 2016; Van Hout & Bingham 2014; Van Slobbe 2016). As one vendor described it, according to Ormsby (2016): ‘JesusOfRave claimed that their team did not start selling on Silk Road only because it was a new means of doing what they were already doing – selling drugs at a profit – but also because the team fully subscribed to the philosophy of the site. ‘This has a large part to do with DPR’s [Dread Pirate Roberts’] writings. We feel we share complementary ethics,’ said a representative’ (p. 66). This idea of vendors acting from a libertarian view was also shared by some interviewees (e.g. EX3, EX13). Furthermore, EX3 indicated that there might be a trend from libertarian vendors in the Silk Road 1.0 era to vendors acting from a financial incentive.
51 More information about Bartlett’s study can be found in Table C1. 52 Again, based on the context in which the information was reported, it is likely that Lahaie et al. (2013) referred to the clear net.
80 Internet-facilitated drugs trade RAND Europe
6.2.3. Previous involvement in offline drugs trade
There were some, primarily anecdotal comments in the literature on vendors being opportunists and some comments about whether these vendors traditionally sold drugs offline and moved to online, or whether it was a new group that did not sell drugs previously. In their study of Silk Road vendors, Van Hout and Bingham (2014) found that two out of the ten vendors interviewed did not sell drugs online or offline previously and none bought drugs online before starting selling drugs on Silk Road. The case file analysis confirmed an instance of both offline and online drugs trade. Similarly, Bartlett (2015) commented that there were both vendors with previous experience in offline drugs trading as well as vendors who did not sell drugs before: ‘some sellers are established middlemen who have been involved in the industry for years and have long-standing relationships with importers; they are simply transferring their operations online. But Silk Road has brought new people into the marketplace, ranging from Ace, a twenty-four-year-old who sold ‘homegrown weed’ on the Silk Road in 2012 – ‘I can take about ten to twenty orders a day, so anywhere from seventy to a hundred and forty a week’—to pharmacologists who illegally sell prescription drugs from their surgeries’ (chapter 5, page not indicated). A few interviewees also indicated that some vendors on online markets did not sell drugs previously (EX3, LE7, LE15, LE16). A law enforcement representative further commented that where arrests were made, actors involved generally did not have antecedents and had limited connections to criminal networks (LE15).53 One explanation might be the ease in which this type of trade can commence, without having a network of contacts in this field, or knowledge of the drugs trade since information on acting on cryptomarkets can be found online (LE15) Ormsby (2016) found that while many vendors on Silk Road were ‘former small-time street dealers who had found a new, lucrative market’, there were also vendors who previously only sold drugs to friends and were now able to deal ‘on a more professional level’ (pp. 62–63). With regard to the NPS market, the Advisory Council on the Misuse of Drugs (2011) commented that this particular market had vendors that did not sell illegal drugs previously, including students. This study, however, did not mention the source of this information and as such should be treated with caution.
6.3. Buyer characteristics, motives and modus operandi
6.3.1. Buyer characteristics
Primary research conducted with drug users who purchase drugs on cryptomarkets found that these consumers were predominantly male (Barratt et al. 2016a; 2016b; Orsolini et al. 201554; Van Buskirk et al. 2016; Van Hout & Bingham 2013a; 2013b). They were mainly adolescents and young adults (Barratt et al. 2016a; 2016b; Orsolini et al. 2015; Van Buskirk et al. 2016), although there were also users in their 50s and 60s who had rediscovered drugs through Silk Road (Ormsby 2016). These characteristics of primarily young and male users were also described by several interviewees (LE2, EX3, EX4, EX6, EX8).
53 The EU country this comment refers to is left out for confidentiality purposes. 54 The study by Orsolini et al. (2015) is not primary research as such, yet reports on these studies in their literature review. Orsolini et al.’s (2015) review also includes research on online prescription drug customers, yet this is not further described in our report.
81 RAND Europe Internet-facilitated drugs trade
Arrest data also confirmed this. Table 6.1 shows that the vast majority of arrested buyers was male (101 men, 9 women and 75 unknown) and with a mean age of 25, they tend to be younger than arrested vendors. Arrested cryptomarket buyers are concentrated in the United States (99), New Zealand (25), Australia (25) and the United Kingdom (18). The absence of the Netherlands may reflect law enforcement priority on supply reduction, rather than prosecuting drug users. One study conducted among a purposive sample of regular psychostimulant users from Australia found that those having bought drugs on cryptomarkets were ‘more likely to be involved in recent property crime’ (Van Buskirk et al. 2016, 1). In terms of buyer characteristics specifically associated with purchasing NPS online, a review of the literature found that age was negatively associated with online purchase of mephedrone, suggesting that younger users may lack the necessary financial and other resources (e.g. having a credit or debit card, or a safe delivery address) to purchase NPS online (Stephenson & Richardson 2014). Silk Road users were based in the United States, the United Kingdom or other parts of Europe, Australia and New Zealand (Barratt et al. 2014; United States District Court Southern District of New York 2013, as cited in Ormsby 2016). Silk Road users held both left- and right-wing political views (Ormsby, 2016), and were often (highly) educated, in tertiary education or professionally employed with disposable income (Barratt et al. 2016b; Ormsby, 2016; Orsolini et al. 2015; Van Hout & Bingham, 2013a, as cited in Mounteney, Griffiths et al., 2016a; Van Hout & Bingham 2013b). Although mainly based on anecdotal evidence or gut feelings, several interviewees confirmed this picture (e.g. EX4, EX6, EX13). Aldridge and Décary-Hétu (2014) hypothesised that Silk Road was suitable for recreational users with the resources and time to purchase drugs online and wait for deliveries. Indeed, primary research with drug users has found that most Silk Road users were recreational drug users who tended to consume drugs on the weekend (Ormsby 2016; Van Hout & Bingham 2013b).55 Given the technological skills needed to access drugs on cryptomarkets (Aldridge & Décary-Hétu 2014), online drug customers, perhaps unsurprisingly, also tended to be web savvy, technologically literate and knowledgeable about Internet security (Ormsby 2016; Orsolini et al. 2015; Van Hout & Bingham 2013b). A few of our interviewees also thought that those buying drugs online were IT-savvy, or at least had some IT skills to enter those markets (e.g. EX6, EX13, LE15, LE16). Through their research based on interviews with 20 Silk Road users, Van Hout and Bingham (2013b) concluded that the need for users to make a conscious decision to access Silk Road, to have technical resources and expertise, and be able to wait for a delivery could act as a deterrence for impulsive and excessive consumers. This was also reflected upon by our interviewees (EX3, EX4, LE14). EX3 and LE14 indicated that those using heroin, for example, might be less willing to wait for their drugs to be delivered. Drug users who are unwilling or unable to plan their consumption in advance may prefer to purchase drugs from known dealers in person (Aldridge & Décary-Hétu 2016b). In terms of drug taking behaviour, some research conducted with Silk Road users found that all had consumed drugs prior to using Silk Road (Ormsby 2016; Van Hout & Bingham, 2013b), while other
55 In their 2014 paper, Aldridge and Décary-Hétu referred to the lack of presence of heroin and crystal meth as evidence of this, but their later paper (2016a) involved thorough by-hand cleaning, and found that the amount of heroin for sale was not inconsiderable.
82 Internet-facilitated drugs trade RAND Europe research with Silk Road users found that there were also users who did not consume drugs previously (Barratt et al. 2016b). Our interview data also found that some buyers did not used drugs before or bought drugs offline previously (EX6, LE16). Many Silk Road users who were interviewed by Ormsby reported using MDMA, psychedelics and cannabis, while a few also purchased heroin and methamphetamine (Ormsby 2016). Some users also reported discovering new drugs through Silk Road (Ormsby 2016; UNODC 2014). Silk Road users self-identified as drug connoisseurs or psychonauts whose drug consumption was based on so-called responsible drug consumerism (Van Hout & Bingham 2013a; 2013b; 2014).56. EX8 also noted that psychonauts bought their drugs online. In a single case study, a Silk Road user reported that he preferred to consume drugs alone as there were ‘too many unknowns’ when consuming drugs in a group (Van Hout & Bingham 2013a). Other Silk Road users also reported using products alone for introspective and psychonautic purposes (Van Hout & Bingham 2013b). Silk Road users also associated themselves with a ‘party culture’ (Barratt, 2012), which may be supported by the finding that half of sales on Silk Road were for cannabis and ecstasy (Soska & Christin 2015). Besides consuming drugs, there is evidence that cryptomarket customers may engage in drug production or dealing. Using web-crawling techniques to collect data on drugs sold on Silk Road, Aldridge and Décary-Hétu (2014, 2016a) reported that their observed sales of precursors demonstrated that some buyers were also illicit drug producers. As mentioned in Section 4.5, Aldridge and Décary-Hétu (2014) also reported that high mean purchase prices in the top quintile for each drug on Silk Road suggested that some buyers were sourcing wholesale stock for retail purposes, as it was unlikely that buyers purchasing drugs for personal use would make purchases in such high amounts. This was also anecdotally confirmed by several of our interviewees (e.g. EX1, EX4, EX10, EX13, LE2, LE9, LE16). Social supply was also prevalent, with groups of friends combining resources and to place orders (Ormsby 2016). Such groups would spread risk by rotating the delivery address for their order (Ormsby 2016). Additionally, an investigative journalist who interviewed Silk Road users over three years reported that buyers tended to stockpile their drugs, as they preferred to receive a large volume of drugs in a single delivery, rather than receiving a high quantity of deliveries (Ormsby 2016). This was contested by some interviewees, who indicated that buyers and vendors try to minimise the risk of detection by shipping smaller quantities of drugs (e.g. LE1, LE16). Overall, primary data collection with Silk Road users found that users strove to keep their use of Silk Road a secret and tried to protect their anonymity for fear of social stigma, personal security concerns and law enforcement action and prosecution (Maddox et al. 2016; Van Hout & Bingham 2013a; Van Hout & Bingham 2013b). However, users felt free to engage in discussions about their drug use behaviours under the cloak of anonymity, for instance on the Silk Road forum (Maddox et al. 2016). There was a positive relationship between online drug information seeking activities and online purchasing of drugs (though the type of drugs, and whether purchases took place on the dark web or clear net were not further defined), suggesting that providing and receiving support online, for instance on fora or blogs, may have
56 According to Van Hout and Bingham (2013b), a psychonaut is ‘a person who intelligently experiments with mind-altering chemicals, sometimes to the extent of taking exact measurements and keeping records of experiences’ (p. 526).
83 RAND Europe Internet-facilitated drugs trade encouraged potential buyers to make online purchases and consume drugs (Orsolini et al. 2015). Orsolini et al. (2015) postulated that the sense of belonging to and participating in a particular group may be particularly important for those who are involved in idiosyncratic or unusual drug use, or for those who live in remote areas.
6.3.2. Buyer motives
In a case study of a single Silk Road user, the participant stated that purchasing illicit drugs on Silk Road was perceived as less risky than buying from street dealers in terms of law enforcement detection and personal safety (Van Hout & Bingham 2013a; 2013b). Based on data from a self-selected sample of cryptomarket users that completed the Global Drugs Survey in 2014, Barratt et al. (2016a) found that ‘cryptomarkets are associated with substantially less threats and violence than alternative market types used by cryptomarket customers’ (p. 1).57 The notion on perception of safety on buying drugs online was also mentioned by EX3 and LE16 during interviews conducted for our study. Other primary research conducted with Silk Road users found that their main motives for using Silk Road to purchase drugs included anonymity (EMCDDA 2015a; Van Hout & Bingham 2013b, as cited in Dolliver, 2015) and the ability to minimise the impact on their work and professional status (Orsolini et al. 2015). Moreover, the convenience of ordering drugs online (Barratt et al. 2014), alongside the ease of speedy stealth delivery of drugs (EMCDDA 2015a; Van Hout & Bingham 2013b, as cited in Dolliver 2015), were cited as benefits. Analysing data collected as part of the Global Drugs Survey from respondents based in the United Kingdom, United States and Australia, Barratt et al. (2014) reported that the main reasons for purchasing drugs on Silk Road pertained to having a wider range of and better quality drugs than users would normally be able to access.58 These reasons, as well as price, were also mentioned by a sample of Australian drugs users who purchased drugs on cryptomarkets (Van Buskirk et al. 2016). Other primary research conducted with Silk Road users found that product variety was also an important reason for purchasing drugs on Silk Road (Van Hout & Bingham 2013a; 2013b, as cited in Dolliver, 2015), and this was also noted by an interviewee in our study with regard to cryptomarkets in general (LE16). In their digital ethnography of 17 Silk Road users, conducted between 2012 and 2014, Barratt et al. (2016b) described how access to a variety of drugs through Silk Road affected the trajectory on drug use for some, with an increase in drug purchases in the beginning, and a decrease at later points in time, when buyers had less desire to purchase the drugs given the abundance of drug availability online. Some users purchased drugs on Silk Road because of the poor quality of street drugs in their locality (Van Hout & Bingham 2013b, as cited in EMCDDA, 2015a). Another commonly cited reason was the ability to purchase drugs from highly rated vendors (Barratt et al. 2014). The New Psychoactive Substances Review conducted in the United Kingdom reported that drug users who consumed NPS included professionals who wanted to
57 The authors noted, however, that the sample mainly used closed networks such as friends when cryptomarkets were not available, and violence should normally be less common in these networks already (Barratt et al. 2016a). 58 Bancroft and Reid (2016), who analysed a dark net user forum and conducted interviews with its participants found that ‘understandings of product quality depended on [users’] experience, the purpose of use, and [the] context [of use]’ (p. 6). For information about the purity of drugs purchased on cryptomarkets, see Caudevilla et al. (2016).
84 Internet-facilitated drugs trade RAND Europe evade workplace drug tests or avoid the risk of prosecution (The New Psychoactive Substances Review Expert Panel 2014). On the other hand, common reasons for not purchasing drugs on Silk Road were having adequate existing networks to purchase drugs, fear of law enforcement intervention, and the technicalities involved – including accessing the Tor browser, arranging credit and purchasing products (Van Hout & Bingham 2013b, as cited in EMCDDA, 2015a).
6.3.3. Modus operandi in buying and receiving of drugs
Based on an initial review, there were only a few studies identified that collected primary data specifically regarding the modus operandi in buying and receiving of drugs. Whilst a description of the mechanisms in purchasing and leaving feedback on cryptomarkets is already described in Section 3.1.1, the current section focuses on modus operandi in more detail and also includes information on clear net markets.
Dark net purchases As described in 3.1.1, there is a feedback mechanism on cryptomarkets available for buyers to review their purchase and service received (Van Slobbe 2016). These feedback mechanisms could be used by buyers to make their purchasing decisions. Silk Road users, for example, reported making purchasing decisions based on feedback from other buyers, but also took into account pricing, ‘trip reports’ and product details on Wikipedia, Erowid, Pubmed, Google Scholar, and vendor reputation (Van Hout & Bingham 2013b). Aldridge and Décary-Hétu (2014), using web-crawling methods, observed that buyers left extremely positive feedback for listings that included ostensible results of laboratory tests for strength and purity, suggesting that buyers are convinced that they are receiving what they have ordered. Indeed, buyers are expected to leave feedback on their experiences with vendors, so that any scammers can be discovered and removed from the market (Aldridge & Décary-Hétu 2014). A study involving qualitative case studies of four online vendors operating on Agora found that buyers provided feedback for vendors on whether the stealth method used to conceal the illicit drugs during shipping was satisfactory (Tzanetakis et al. 2016). In a study involving online observations and interviews with 20 Silk Road users, participants reported that purchases on Silk Road had largely replaced buying from their local street dealer, though some users relied on street markets, friends and peer networks for drugs while waiting for drugs purchased on Silk Road to be delivered (Van Hout & Bingham 2013b). It was not clear, though, if cryptomarkets had changed other purchasing behaviours of drug users. For instance, Aldridge and Décary-Hétu (2014) argued that cryptomarkets such as Silk Road have led to the internationalisation of markets, as they allowed buyers to purchase drugs from vendors around the world, to purchase drugs that are not locally available and to shop around for lower prices. However, it appears that buying internationally may not be common – for instance, for Australian-based buyers who preferred to purchase drugs from local sellers (Mounteney, Griffiths et al. 2016). The same trend was seen in Sweden, according to one of the interviewees in our study (LE16).
85 RAND Europe Internet-facilitated drugs trade
Clear net purchases59 When controls are imposed on NPS, buyers may stop purchasing the drugs from websites. For instance, findings from a self-selected sample of readers who responded to the MixMag dance music magazine survey in 2010 and 2011 showed that after the controls on mephedrone were implemented in the UK, there was a shift from buying mephedrone from websites to purchasing from street dealers (Advisory Council on the Misuse of Drugs 2011). However, even prior to the ban, only 33 per cent of respondents purchased mephedrone from websites; after the ban, this figure fell to 1 per cent (Advisory Council on the Misuse of Drugs 2011). Similarly, a survey of over 1,000 school, college and university students in Scotland found that prior to the classification of mephedrone, only 10.7 per cent of users purchased mephedrone online (Dargan 2010, as cited in Stephenson & Richardson 2014).
The role of trust One key theme that emerged in the literature review was that, similar to traditional, offline drug markets, trust between buyers and vendors is a crucial component in purchasing illicit drugs on online marketplaces. The role of trust on online marketplaces was also mentioned by several interviewees (e.g. EX6, LE1, LE9). Van Hout and Bingham described the relationship between vendors and buyers as being characterised by trust and professionalism (Van Hout & Bingham 2013a, as cited in Tzanetakis et al. 2016). It is considered important to build and maintain a good reputation as a buyer or vendor (e.g. Bartlett 2014) via feedback from other parties. This is highlighted by Aldridge and Décary-Hétu (2014), who commented that in the world of the drugs cryptomarket, having a good reputation ‘may be more important than muscles and face-to-face connections’ (Aldridge & Décary-Hétu 2014, 16; the importance of reputation was also mentioned by EX18). Aldridge and Askew (2016) have analysed how drug vendors engender trust particularly in novice cryptomarket buyers in the way they ‘advertise’ their products and services on drug cryptomarkets and convey a sense of themselves as ‘reliable transactors’, particularly given the ever-present possibility of scams on both sides of the transaction. These vendor-written texts function as service and product quality indicators, which, alongside marketplace regulatory features, have been suggested to reduce the information imperfections typically thought to characterise illegal marketplaces (Aldridge et al. 2016), making cryptomarkets resemble legal marketplaces in some key elements. Buyers on cryptomarkets appear to develop strong relationships with sellers. An investigative journalist who interviewed Silk Road users over three years found that following the closure of Silk Road, users simply migrated to alternative markets (Sheep and Black Market Reloaded) where they could verify that they were working with the same vendors as before through the use of encrypted signatures (Ormsby 2016). Other users who had formed relationships with their favourite vendors responded to the Silk Road seizure by bypassing the cryptomarket and conducting subsequent transactions via secured email (Ormsby 2016). A similar practice was also noticed by LE9, who indicated that establishing mutual trust was paramount to facilitating transactions. Once such trust has been established, vendors and buyers may scale up the number of transactions and the volumes through other communication channels (LE9).
59 The articles used in this section refer to NPS sold on ‘websites’, yet do not specify for clear net or cryptomarkets. However, given the context of these studies it is highly likely that ‘websites’ refer to clear net websites.
86 Internet-facilitated drugs trade RAND Europe
Where a vendor has established a trustworthy reputation through previous sales and positive feedback, customers were reportedly willing to accept early finalisation (Tzanetakis et al., 2016). Tzanetakis et al. (2016) argued that vendors who have increased their reputation through building up trust with existing buyers were also subsequently able to attract new customers, as the trust reduces buyers’ perception of the risk of purchasing illicit drugs from a stranger on the dark net (Tzanetakis et al. 2016). A study employing systematic online observations and interviews with 20 Silk Road users found that buyers’ experience of several successful transactions and quality products appeared to positively affect their loyalty to certain vendors (Van Hout & Bingham 2013b). Conversely, some buyers reported that with unknown vendors they would initially purchase small amounts of illicit drugs to sample (Van Hout & Bingham 2013b). Besides providing feedback on cryptomarkets, buyers were also able to submit reviews on vendors on Subreddits – categories on reddit.com – such as Agora and DarkNetMarkets, which other users could then comment on (Tzanetakis et al. 2016). While the level of detail of these reviews varies, they were typically more detailed than the feedback submitted on vendors’ profile pages (Tzanetakis et al. 2016). In sum, emerging evidence on the role of trust in online marketplaces shows that there were different ways in which both vendors and buyers signal and establish trust online.
6.4. In sum
There is consensus in previous literature and interviews and case file analysis that five key actors are knowingly involved in cryptomarkets: administrators (executive management and treasurer), developers (web design and maintenance), moderators (staff members on the marketplace), and finally, vendors and buyers selling and purchasing on these marketplaces respectively (the latter two also identified in data on clear net markets). Additionally, there is agreement that others (could) have supporting roles, some knowingly and others unknowingly: bitcoin exchangers, Internet Service Providers, suppliers of legal goods and postal services. This chapter described two of these actors, vendors and buyers, in more detail. Based on limited, sometimes anecdotal, evidence from the literature, interviews and case file analysis, the characteristics, motives of vendors and characteristics, motives and modus operandi of buyers was explored. These findings primarily related to cryptomarkets as evidence for the clear net was limited. Furthermore, most of the studies that reported on characteristics and modus operandi of these actors were based on small sample sizes and focused on specific cryptomarkets or countries. As such, these findings are not representative for all actors on online marketplaces. However, based on these limited studies, some common findings were identified. One common finding across studies and interviewees was that vendors were relatively young (under the age of 40), educated and entrepreneurial men with strong IT-skills. Broadly consistent with our scraped cryptomarket data, they mainly came from Anglo-Saxon or Western European countries. Additionally, some were both vendors as well as buyers (consumers) of drugs. Furthermore, anecdotal evidence showed a mix of vendors who already had established offline drugs trade businesses and vendors who never sold drugs previously. Vendors were attracted to sell drug online for various reasons, including financial motives, libertarian ideologies and the feeling of personal safety on online platforms.
87 RAND Europe Internet-facilitated drugs trade
Similarly, buyers were relatively young, educated and tech-savvy males from Anglo-Saxon and (other) European countries. These were mainly recreational drug users (some considered themselves ‘psychonauts’) who used drugs previously. The latter was however contested by some anecdotal evidence from interviews. Moreover, it was found that while for some buyers a cryptomarket replaced buying from their local dealer entirely, for others they still relied on other, offline avenues as well. Similar to our cryptomarket data on wholesale, previous research found that most buyers purchased quantities for personal use, but some buyers also bought larger quantities for retail purposes or social supply. In addition, some buyers bought precursors for illicit drug production. Motives for buying drugs online primarily included perceptions of increased safety when buying online, quality and product variety drugs available online, anonymity and the ease of speedy stealth delivery. There was limited primary research on the modus operandi of buying drugs online. Buyers reported to make purchases based on pricing, reviewing ‘trip reports’, products details on websites such as Wikipedia, vendor reputation and feedback from other buyers. The latter, leaving feedback, was expected from buyers who purchased drugs on cryptomarkets. It was also found that the role of trust between vendors and buyers is a key component in purchasing drugs online – an element that is also identified in offline drug markets – and there are different ways in which both vendors and buyers signal and establish trust online. Finally, for both buyers and vendors, and as reflected in other work (e.g. Trautmann 2016), there is currently insufficient evidence to make statements on whether the presence of online drug markets leads to new actors that previously would not have sold or bought drugs offline, or whether the offline market is substituted by online markets.
88
7. Detection and intervention of Internet-facilitated drugs trade
Law enforcement is one of three pillars of Dutch drugs policy, alongside prevention and harm reduction. There have been several law enforcement investigations in the field of Internet-facilitated drugs trade in the Netherlands (see Box 7.1). Some of these have led to arrests and convictions. This chapter provides an overview of potential modes for detection and intervention in the Netherlands and other countries. As such, this study takes stock of the practices that are currently being deployed, or they could potentially, in the Dutch and international context (research questions’ cluster D, see Table 1.1). Based on findings from in-depth interviews with Dutch and foreign law enforcement experts and complemented by literature data, different strategies were identified and verified with Dutch focus group participants. These strategies, and their possible barriers, are outlined in this chapter.
7.1. Scope of this chapter
There are a few notes of caution that should be taken into account when reading this chapter. Firstly, this study only aimed to provide a high level overview of strategies and their related barriers as identified by interviewees or in the literature, and is not intended to provide a comprehensive mapping of all strategies. Secondly, Internet-facilitated drugs trade is still a relatively new and continuously evolving phenomenon, and the same goes for responses to this phenomenon by Dutch and international law enforcement agencies. Accordingly, strategies may not be fully developed yet. In addition, while it is recognised that Internet-facilitated drugs trade crosses borders, approaches to detection and investigation deployed in other countries might not be directly applicable to the Dutch context. Moreover, and perhaps unsurprisingly, the majority of law enforcement interviewees indicated they were not allowed to comment on the details of the strategies used, as this might be used by actors involved on these marketplaces to avoid detection. Therefore, these findings are based on limited interview data. Similarly, it is likely that for the same reason, the identified studies did not report on sensitive data. As such, the strategies and their barriers discussed in this chapter may not be exhaustive. Following the caveats mentioned here, this study did not aim to provide recommendations for Dutch law enforcement organisations, but merely aimed to provide an overview of some existing (or proposed) strategies. Furthermore, while most of the findings relate to cryptomarkets, some of these avenues could also be used for tackling Internet-facilitated drugs trade on the clear net. Focus group participants, however, indicated that this currently has low priority for law enforcement. Finally, some authors and interviewees (e.g. Martin 2014b; EX3, EX4) argued that the existence of online drug marketplaces might actually be a safer option for the different actors involved compared to offline
89 RAND Europe Internet-facilitated drugs trade drugs trade, and that as such, intervention in these online marketplaces might not be the preferred approach. However, since the aim of this study was to identify possibilities for detection and intervention, this study did not report on other possible strategies.
7.2. Four modes of detection and intervention
Findings from the in-depth interviews and the literature review suggested four separate strategies that are or can be used in the detection and intervention of the Internet-facilitated drugs trade. These strategies were presented to and verified with Dutch law enforcement experts and other experts during the focus group as held during the final phases of this study. These verified strategies are outlined below and further described in the following sections: 1. Traditional investigation techniques applied in the drug chain; 2. Postal detection and interception; 3. Online detection; and 4. Online disruption.
In earlier work, Christin (2013) already suggested four possible intervention strategies to disrupt Silk Road operations: disrupting the network, disrupting the financial infrastructure, disrupting the delivery model, and laissez-faire. The first strategy involved disrupting the Tor network, which Christin (2013) acknowledged would be difficult to implement. The second strategy involved capitalising on bitcoin’s volatility by manipulating the currency, or de-anonymising bitcoin users. The third strategy involved increasing controls at the post office or at customs to seize drug shipments. The last strategy involved non- intervention based on a drug abuse prevention approach, compared to enforcing drug prohibition (Christin 2013).
7.2.1. Traditional investigation techniques applied in the drug chain
Mounteney, Griffiths et al. (2016) highlighted that although sales activities for Internet-facilitated drugs trade take place online, there are still physical components in cultivating, producing, and distributing the drugs. Traditional investigation techniques, such as physical observation and undercover operations, exploit the weak links in the chain where the digital and offline worlds meet (the ‘Achilles’ heel’ of vendors, LE1). The use of traditional investigation techniques was also raised by several Dutch interviewees and confirmed by focus group participants (e.g. EX13, LE1, LE2, Focus Group). Examples of points where the digital and offline worlds meet include when drugs are sent via postal services or where money laundering (through actors such as bitcoin exchangers) is involved. With regard to the latter, and according to the Dutch public prosecution office, Internet-facilitated drugs trade ‘increases demand for anonymous bitcoin exchange, a practice that allows for the deployment of rigorous investigation methods’ (Kooistra & Trommelen 2014, no page)60. This was also confirmed during the focus group, where it was indicated that in the case of this exchange taking place offline, techniques like
60 Freely translated from Dutch: “De onlinehandel leidt volgens Justitie ook tot een grote vraag naar anonieme inwisseling van bitcoins naar normale valuta, waarop goede recherche mogelijk is.” (Kooistra & Trommelen 2014, no page).
90 Internet-facilitated drugs trade RAND Europe physical observation could be placed on the bitcoin exchanger in order to capture the exchange taking place. As such, traditional investigation approaches including surveillance and using undercover law enforcement officers can be used to disrupt online marketplaces (e.g. LE1, LE2, LE9, LE13). Buxton and Bingham (2015) reported that to date, law enforcement responses to cryptomarkets have relied on traditional strategies of surveillance, interdiction and prosecution, using techniques including informants, undercover surveillance and tracking. Finklea (2015) cited another example of law enforcement collecting personal data about users on a forum about cryptomarkets by issuing a subpoena to Reddit. On this forum, topics like online drugs sales were discussed. Finklea (2015) however warned that such law enforcement strategies may eventually drive users to anonymous forums such as those on Tor.
Barriers to traditional investigation techniques applied in the drug chain The use of traditional law enforcement techniques has limitations in tackling Internet-facilitated drugs trade. One limitation is the potential imbalance between the costs and benefits of using traditional investigation methods. For instance, Martin (2014b) highlighted that it is expensive and invasive to conduct undercover and surveillance operations on suspected drug buyers, while most buyers are likely to purchase only small amounts of drugs. In addition, in the offline world, using such means to target buyers may be easier to justify if buyers can be compelled to provide information about their suppliers, enabling law enforcement to target the supply chain. However, users who purchase their drugs on the Internet or cryptomarkets are unlikely to be able to provide identifying information or evidence about vendors (Martin 2014b). A barrier relating to focusing on bitcoin exchangers, as mentioned by focus group participants, involves the fact that dealing in bitcoins as such is not illegal under Dutch law, which makes money-laundering investigations difficult. Furthermore, money tends to flow through foreign banks and bitcoin exchangers, which limits intervening in these practices.
7.2.2. Postal detection and interception
As mentioned in the previous section, the delivery process presents a key opportunity for law enforcement detection and intervention of Internet-facilitated drugs trade (e.g. LE1, LE2, LE16, Focus Group). As Barratt (2012) stated, ‘at the end of the transaction, the physical product still needs to be sent to the buyer’. To increase the odds of intercepting drug deliveries, the 2013 EU Drug Markets Reports suggested that it will be necessary to simultaneously raise awareness and increase vigilance among postal and courier services (EMCDDA & Europol, 2013), while Van Slobbe (2016) suggested professionalising checks on parcel post. These measures would require collaboration with parcel services and using advanced screening techniques. Examples include using track and trace information – used by sending and receiving parties to follow progress of shipments – as obtained from post offices and surveillance at post offices (LE1). An example from a European country as mentioned by LE11 involved a case whereby undercover law enforcement officials bought drugs on a cryptomarket, and traced the vendor as his return address was included on the parcel. Dutch interviewees were positive about collaboration between law enforcement agencies and postal services (LE5, Focus Group). From September 2016 onwards there will be a so-called ‘post team’, consisting of six parties such as police, postal service and customs, who will focus on collecting
91 RAND Europe Internet-facilitated drugs trade information these shipping practices and thinking about potential barriers that can be put up in the chain (Focus Group).
Barriers to postal detection and interception The process of shipping goods between countries provides law enforcement with the opportunity to detect and intercept illicit drugs (Barratt 2012; Martin 2014b), but legal restrictions related to secrecy of correspondence in the Netherlands may be a barrier to introducing more stringent screening of parcels. Additionally, Martin (2014b) highlighted four problems with the strategy of postal detection and interception. First, the expanding volume of international trade places a large burden on the limited resources of customs agencies (also mentioned by LE1). According to Martin (2014b), customs officers are therefore increasingly forced to concentrate on postal items that appear highly suspicious instead of going through all items. Second, vendors use highly sophisticated concealment techniques in shipping drugs, and discussion forums are constantly updated with information on how to successfully avoid detection. One technique as mentioned by several interviewees is to avoid shipping from the Netherlands altogether, since these parcels tend to be picked up by foreign customs (outside the EU), for example by sending the parcel from Germany (e.g. EX3, LE1, LE9, LE16). A related issue is the internal market in the EU, in which mail and parcels sent within the EU are generally not checked (LE11, LE14). Martin (2014b) further noted that buyers are provided with information on how to frustrate law enforcement methods by using false names and addresses. Third, moreover, drugs are often bought in small quantities, which mean that they can be shipped in regular, inconspicuous envelopes (Martin 2014b). Finally, the feedback system helps to ensure that vendors who use effective concealment methods are rated more highly and are consequently rewarded with increased business (Martin 2014b).
7.2.3. Online detection and monitoring
Online detection employs various strategies to de-anonymise players involved in Internet-facilitated drugs trade (e.g. LE11). For instance, in order to identify vendors, Van Slobbe (2016) proposed that law enforcement should invest in big data techniques to link aliases and Internet activity with IP addresses. Combining different data sources, tools and techniques using big data analytics and machine learning could be deployed to connect different data sources and eventually de-anonymise cryptomarket actors. At the time this study was conducted, we were not aware of these techniques already being deployed for these purposes (i.e. de-anonymisation of cryptomarket actors). While we do not discuss these techniques in detail here given the scope of this study, note that the development and use of these techniques would require investments in capacity, infrastructure and skills.
Continuous, proactive (automatic or manual) monitoring of online marketplaces was also mentioned in the literature and by interviewees as a preferred method (e.g. EMCDDA 2015a; EMCDDA and Europol 2013; Lavorgna 2016; LE1, LE5, LE9, Focus Group).
Another method of identifying individuals is to ‘follow the money’ – in other words, to track money flows in the drugs trade in order to identify the individuals involved. Indeed, Villasenor, Monk and Bronk (2011) suggested that government agencies should keep abreast of new and emerging money transfer methods (as cited in Steward 2013), and Europol’s Internet Organised Crime Threat Assessment highlighted that investigative action against the criminal use of cryptocurrencies must be prioritised in
92 Internet-facilitated drugs trade RAND Europe order to tackle the abuse of anonymity in virtual currency schemes (Europol 2014). This method may be employed with cryptocurrencies, such as bitcoin. As bitcoin (or other cryptocurrencies) purchases must be made from established, legitimate bitcoin vendors, and generate corresponding official financial records, law enforcement agencies can also conduct ‘block chain analyses’ to identify users by monitoring and tracking bitcoin transactions (Ciancaglini et al. 2016; Cox 2016b; Martin 2014b). However, due to, among others, the dynamic landscape of cryptocurrencies, block chain analysis is a complex process and requires a resources-intensive approach. Villasenor, Monk and Bronk (2011) suggested that governments should establish partnerships with private sector entities, such as mobile money transfer platforms and banks, to track money flows (as cited in Steward 2013). Focus group participants confirmed collaboration with Dutch banks to spot inexplicable capital.
Barriers to online detection and monitoring In addition to limitations regarding the capacity, resources and capabilities to undertake online detection strategies in the Netherlands (as discussed in Section 7.2), several challenges were identified in the literature. Ciancaglini et al. (2015) listed three challenges to law enforcement related to online detection: encryption, attribution and fluctuation. First, Ciancaglini et al. (2015) noted that due to encryption on cryptomarkets, even if law enforcement was able to seize a cryptomarket’s servers, officers would not necessarily be able to identify customers, vendors, or where illicit drugs are being sent (Cox 2016b; Martin 2014b). Interviewees (LE9, LE15) also pointed to the issue of encryption, for example around confiscating encrypted servers (LE9). Second, it is difficult to attribute activity to individuals because all activity takes place on .onion domains and routing to the domains is not clear (Ciancaglini et al., 2015). Third, Ciancaglini et al. (2015) stated that the deep web is extremely dynamic, with frequent changes to naming and address schemes. In addition, and as further elaborated on in the next section, the actors on these marketplaces are also dynamic. The dynamic nature of online marketplaces means that in order to document and successfully prosecute crimes, law enforcement officers must be able to rigorously document illegal activity (Ciancaglini et al. 2015). In addition, and although referring to cyber- investigations more broadly, Koops and Goodwin (2014) argued that digital evidence (compared to physical evidence) is more vulnerable to manipulation and removal. Furthermore, as indicated by several law enforcement interviewees, there are still considerable legal barriers to online detection and monitoring, restricting the competencies of the police. Introduction of the proposed bill for the Dutch Act on Cybercrime III (Wetsvoorstel Computercriminaliteit III) aiming to amend the law on cybercrime and includes, among others, will offer investigative authorities the authority to access computers from a distance (to block access to data, or to conduct surveillance, for example) (Buwalda & Kwakman 2014; Rijksoverheid 2015). While increased legal possibilities may expand the surveillance competencies and there enhance effectiveness of law enforcement, there will be inherent trade-offs with privacy protection and Internet freedom. Finally, Martin (2014b) noted that bitcoin is increasingly used for legitimate purposes, which means that individuals who trade in bitcoin may not necessarily be engaging in criminal activity, something that was also pointed out by focus group participants.
93 RAND Europe Internet-facilitated drugs trade
7.2.4. Online disruption
Closely linked to online detection, online disruption involves reducing the trust around anonymity and the reliability of cryptomarkets (EMCDDA 2015a; Mounteney 2016b; Van Slobbe 2016), as well as identifying, arresting and prosecuting vendors (EMCDDA 2015a; Mounteney 2016b). In practical terms, law enforcement officers may work to diminish trust through undercover or covert operations and infiltrating online markets (EMCDDA 2015a; Mounteney 2016b), also known as ‘lemonising’ the market (Franklin et al. (2007, as cited in Hoe et al. 2012), The underlying assumption is that removing the anonymity of buyers and sellers would make online marketplaces less attractive to use (Van Slobbe 2016). As part of online disruption, law enforcement may also attempt to disrupt the market using high profile ‘takedowns’ (e.g. Buxton & Bingham 2015; EMCDDA 2015a; Mounteney 2016b; LE9, LE15). Examples of takedowns are Operation Onymous and Commodore (see Box 7.1). Ensuring that these takedowns receive media attention is intended to make individuals aware of police presence and thus can act as a deterrent (EMCDDA 2015a; Mounteney 2016b). Hutchings et al. (2016), who conducted interviews with 24 stakeholders – including law enforcement officials – involved in website (not just cryptomarkets) takedowns, found several reasons to take down websites, of which one related to discouraging motivated offenders. The authors noted that ‘forum and marketplace takedowns done in tandem with other law enforcement activities may reduce the presence of motivated offenders by decreasing trust in reappearing websites’ (Hutchings et al. 2016, 6). Accompanying a takedown with arrests could have the effect of increasing ‘the perceived risk of being detected and prosecuted’ (Hutchings et al. 2016, 6). The above mentioned techniques on online disruption, however, might depend on the legal possibilities available in a country.
94 Internet-facilitated drugs trade RAND Europe
61 Box 7.1. Examples of law enforcement interventions
Operation Onymous was an internationally coordinated police operation led by the FBI in the United States and involving authorities in 21 countries (Europol 2015). On 5 November 2014, the FBI, together with the U.S. Drug Enforcement Administration, Homeland Security Investigations, and European law enforcement agencies acting through Europol and Eurojust, shut down multiple marketplaces including Silk Road 2.0, Cloud 9, Hydra, Pandora, Blue Sky and Black Market (Aldridge & Décary-Hétu 2016; Buxton & Bingham 2015; Dolliver 2015; Van Slobbe 2016). Operation Onymous also shut down money laundering websites including Cash Machine, Cash Flow, Golden Nugget and Fast Cash (Van Slobbe 2016). The authorities were able to seize 619 .onion domains, bitcoins worth €900,000 and €180,000 at the time, and drugs, gold and silver (Europol 2015), and made arrests of 17 individuals in 17 countries, including the alleged operator of Silk Road 2.0, Blake Benthall (Aldridge & Décary-Hétu 2016; Dolliver 2015). What was reportedly unique about Operation Onymous was that it involved an undercover agent who had been working as an administrator on Silk Road 2.0 since the market emerged, highlighting that anonymity can both support and undermine the Internet-facilitated drugs trade (Aldridge & Décary- Hétu 2016). Operation Commodore was an undercover operation conducted by the Dutch and German police in 2013 and 2014 (Security.nl 2014). Undercover activities included the online purchase of drugs and weapons. Law enforcement authorities took down a marketplace called Utopia, and seized, among others, 900 bitcoins (worth €400,000 at the time) from the suspects involved. The German police also seized servers in Bochum and Düsseldorf, while the Dutch police arrested several Dutch citizens (Security.nl 2014).
Barriers to online disruption The main barrier to online disruption is the speed at which buyers, sellers and administrators are able to adapt to cryptomarket takedowns (EMCDDA 2015a). It appears that marketplace takedowns have had little long-term impact (Buxton & Bingham 2015; Ormsby 2016; Tzanetakis et al. 2016). Impacts of the closure of the original Silk Road and Operation Onymous included an increase in the prices of illegal goods (Europol 2015), a temporary fall in the value of bitcoin (Buxton & Bingham 2015; Van Buskirk et al. 2014), and an increase in the market share and price of cannabis (potentially because the penalty for buying and selling cannabis was lower compared to other drugs) (Soska & Christin 2015). Box 7.2 further elaborates on the possible consequences of taking down online marketplaces.
61 Between February 2015 and January 2017, another European initiative has been taking place, called the ‘Joint investigation to combat drug trafficking via the virtual market (darknet) within and also into the EU (JICDT-VM)’. It is led by the Austrian Federal Criminal Police Office with support from Germany and aims to ‘form operational criminal intelligence networks and to carry out investigations in virtual marketplaces on the Internet, focused on combatting international drug trafficking in connection with cybercrime’ (Federal Ministry of the Interior 2015). Other parties involved include: all Member States, Europol, Eurojust, Interpol, EMCDDA, the European Commission and the UNODC.
95 RAND Europe Internet-facilitated drugs trade
Box 7.2. Possible consequences of taking down online marketplaces
Displacement to existing marketplaces The main consequence of bringing down marketplaces has been the migration of vendors and customers to other existing markets (Digital Citizens Alliance 2014a; Mounteney, Griffiths et al. 2016; Ormsby 2016; Soska & Christin 2015; Van Buskirk et al. 2014). For instance, within weeks of Ross Ulbricht’s arrest and the takedown of Silk Road 1.0 in October 2013, both Black Market Reloaded and Sheep Marketplace experienced drastic growth (Buxton & Bingham 2015; Digital Citizens Alliance 2014a). Both marketplaces provided a mechanism for verifying Silk Road vendors, which encouraged customers to migrate along with the vendors (Buxton & Bingham 2015; Ormsby 2016). Following the takedown of Silk Road, a new Finnish marketplace also emerged on the deep web to cater for customers based in Finland (Mounteney, Griffiths et al. 2016). Subsequently, Operation Onymous, conducted in November 2014, resulted in the displacement of vendors and customers to the remaining marketplaces, including Agora and Evolution (Europol 2015; Soska & Christin 2015). The closure of Evolution in March 2015 following an exit scam also displaced vendors and customers to Agora, and smaller markets such as Abraxas, AlphaBay, Black Bank and Middle Earth (Europol 2015). Development of new marketplaces The takedown of marketplaces has also led to the development of new marketplaces. For instance, Silk Road 2.0 was launched about one month after the closure of the original Silk Road (Buxton & Bingham 2015; Digital Citizens Alliance 2014a; Hutchings et al. 2016; Soska & Christin 2015; Van Slobbe 2016). Other marketplaces following the same model of offering an online platform for vendors and customers to interact also emerged (Buxton & Bingham 2015; Europol 2015; Soska & Chrisin 2015; Van Slobbe 2016). As Buxton and Bingham (2015) noted: ‘According to Mike Power, arrests and the closure of Silk Road version: Has inadvertently been the most brilliant advertising for hidden web drug markets. The FBI have acted as the most creative marketing and advertising agency that the hidden web drugs sector could have possibly have hoped for’ (p. 14). In addition, law enforcement takedowns have also encouraged the development of new security and technical features (Buxton & Bingham 2015; Mounteney, Griffiths et al. 2016a; Ormsby 2016; Van Slobbe 2016). For instance, some markets will only admit new members who have received an invitation from an existing member (Mounteney, Griffiths et al. 2016; Van Slobbe 2016). Cryptomarkets are increasingly using more covert communication and advanced encryption techniques (Mounteney, Griffiths et al. 2016). Decentralised, open source, markets have also developed to combat future marketplace takedowns (Buxton & Bingham 2015; Ormsby 2016).
Use of other methods of trading In the wake of the shutdown of the original Silk Road, some customers reported that they would return to traditional methods of purchasing drugs (Ormsby 2016). Other users resorted to bypassing the cryptomarkets entirely by transacting directly with their favourite suppliers via secured email (Ormsby 2016).
Impact on trust in the marketplace Same argue that law enforcement actions and scams have potentially resulted in a loss of confidence in cryptomarket platforms, which may limit the future growth of the drug cryptomarket (Aldridge & Décary-Hétu 2016; Europol 2015; Maddox et al. 2016). However, others have suggested that trust and confidence have not been significantly diminished or are quickly restored (Soska & Christin 2015; Van Buskirk et al. 2014). Users have also reported that the closure of the original Silk Road did not diminish their desire to exercise their personal freedoms, for instance through using other marketplaces on the dark web (Maddox et al. 2016). It has also been suggested that the negative impact of scams on trust within the market (Digital Citizens Alliance 2014a; Soska & Christin 2015) was greater than what law enforcement action could achieve (Europol 2015). Compared to law enforcement crackdowns, scams also had a larger impact on the longevity of cryptomarkets (Aldridge & Décary-Hétu 2016), undermining the overall impact of law enforcement takedowns.
96 Internet-facilitated drugs trade RAND Europe
7.3. Lessons for detection and intervention of Internet-facilitated drugs trade
Based on findings from the in-depth interviews, focus group and the literature, two cross-cutting, key elements were identified that could play a facilitating role in applying the four strategies in detection and intervention of Internet-facilitated drugs trade.
Firstly, since Internet-facilitated drugs trade crosses borders, it was noted by both interviewees and in the literature that international cooperation and coordination is key in tackling Internet-facilitated drugs trade (e.g. Europol 2014; Europol & EMCDDA 2013; LE2, LE11, LE15). Previous and current examples of internationally coordinated projects include Project ITOM (Illegal Trade on Online Marketplaces) and Project EMPACT (an EU-wide police project including 22 countries and focusing on – among many other subjects – tackling cryptomarkets).62 Law enforcement cooperation between countries is, of course challenging. Joint law enforcement interventions could require mutual legal assistance requests given the involvement of different jurisdictions (Hutchings et al. 2016; LE17). Furthermore, there are legal challenges involved in tackling this phenomenon that crosses borders, for example when the legality of substances sold online differs per country (Trautmann 2016, 9).
Secondly, key barriers to online detection are capacity and resources to undertake this, and the (technical) capabilities of law enforcement officials to tackle Internet-facilitated drugs trade. This point was also raised by several Dutch interviewees and participants of the focus group (e.g. LE1, LE14, Focus Group). Interventions such as online detection and disruption are time-consuming and require a certain level of technical (and sometimes financial) skills. There have been, however, developments in this field, as a dedicated ‘Dark Web Team’ at the Dutch police was recently established. This team aims to monitor developments in the field of Internet-facilitated drugs trade. In addition, Interpol, together with the Netherlands Organisation for Applied Scientific Research (TNO), hosted a dark net training course in the summer of 2015, in which law enforcement representatives from several countries (including the Netherlands) had the opportunity to participate in a simulated online marketplace (Interpol 2015).
In sum, international cooperation and coordination (and the accompanying legal challenges), capacity and resources, and (technical) capabilities could play a facilitating role in deploying the different strategies to tackle Internet-facilitated drugs trade.
62 EMPACT is the European Multidisciplinary Platform against Criminal Threats. EMPACT is a platform administered by Europol, supporting law enforcement and other practitioners involved in the implementation of the EU Organised Crime Policy Cycle. The Policy Cycle includes Drugs (cocaine and heroin), and Cybercrime as priority areas (Council of the European Union 2010).
97
8. Conclusions
In this chapter we revisit the research questions set out for this study and synthesise the findings for each of them based on the evidence collected presented in previous chapters. Limitations to our approach, described in Chapter 2, should be borne in mind when considering our responses to the research questions. Before answering the research questions in detail, we draw some general conclusions. Overall, we found that – similar to many markets for licit goods and services – the Internet has created new business models for drugs trade. On the hidden or dark web, so-called cryptomarkets and vendor shops, accessible through encryption software, bring together vendors and buyers for illegal goods and substances, mostly illicit drugs. Cryptomarkets quickly gained popularity between 2011 and 2013 with the rise and fall of Silk Road 1.0. A month before it was taken down by the FBI, researchers estimated monthly revenues for drugs trade on Silk Road at more than $7m. Drugs trade via cryptomarkets has shown to be resilient to law enforcement intervention and distortion, as new market places quickly emerged and gained market share. At the moment, there are purportedly about 50 cryptomarkets and vendors shops on the dark web. Since the heyday of Silk Road 1.0 in 2013, however, we conclude that the evolution of drugs trade via cryptomarkets is one of incremental change, rather than explosive. Revenues have about doubled since then, and the total number of transactions has tripled. There is also some continuity in the market share of different drug types and the proportion that can be labelled as wholesale. But despite considerable challenges, such as declining trust due to scams and law enforcement take downs, cryptomarkets have survived. Yet, they represent a niche of drugs trade at large, as they constitute a fraction of the total drug market in the offline world. Whereas the total retail value of the European drug market is estimated at a minimum of €24bn for 2013 (EMCDDA 2016a) – an average of around €2bn per month – our data suggested global monthly revenues for cryptomarkets in the double digit million Euros (i.e. a minimum of $ 12.0m or €10.6m and a maximum of $21.1m or €18.7m). The availability of NPS via web shops on the clear net on the other hand, appeared to have increased quickly. There were, however, no reliable estimates of size and scope of NPS trade via the clear net and the size of the buyer population is unclear. Cryptomarkets are dominated by vendors who indicate they are operating from Anglo-Saxon countries (United States, Canada, Australia and the United Kingdom) and Western Europe (the Netherlands, Germany, Spain, France). Revenues to vendors operating from the Netherlands, however, are by far the largest on a per capita basis. This is perhaps not surprising given its important role in production and transit of drugs in Europe. The prominence of ‘Dutch vendors’ is particularly obvious for synthetic drugs,
99 RAND Europe Internet-facilitated drugs trade which they sell in wholesale quantities more than vendors operating elsewhere. Furthermore, evidence suggests they export and domestic sales are a limited proportion of their business. The share of ‘Dutch vendors’ in the market for cannabis on cryptomarkets, however, is surprisingly small. While this study identified some information on the characteristics and motives of vendors and buyers involved in Internet-facilitated drugs trade, there is currently insufficient evidence to conclude whether the presence of online drug markets leads to new vendors or buyers that previously would not have sold or bought drugs offline, or whether the offline market is substituted by online markets.
Merchandise 1. Which types of drugs are being traded over the Internet? And how does the size of trade of different types of drugs relate to one another? (Section 4.3 and 4.4)
Our results show that of all products and services on offer on the eight cryptomarkets examined in this study, 57 per cent of listings offered drugs. The results indicate that these drugs listings generated a total of monthly revenue of $14.2m (€12.6 million) and $12.0m (€10.6m) when prescription drugs and alcohol and tobacco were excluded. These figures represent a lower-boundary estimate, as there are several caveats that cause our data from eight of the largest cryptomarkets cover about 80 per cent of all listings. Moreover, we assume at least 71 per cent of all transactions generated feedbacks, which we used to calculate revenues. An upper-boundary estimate for January 2016 drug revenues via visible listings63 on all cryptomarkets would be $25.0m (€22.1m) and $21.1m (€18.7m) when prescription drugs and alcohol and tobacco are excluded. Those drugs listings were dominated by cannabis (30 per cent), prescription drugs (24 per cent), ecstasy- type substances (17 per cent), stimulants (13 per cent) and psychedelics (11 per cent). Cannabis also generated the highest revenues, 31 per cent of all drugs revenues, followed by stimulants (24 per cent), ecstasy (16 per cent), psychedelics (8 per cent) and opioids (6 per cent). These revenue shares more or less mirror the retail value of different drug types in the offline world, particularly for stimulants and cannabis. Our results show that ecstasy-type drugs however, appeared to be much more popular on cryptomarkets than out on the street, as they only constitutes about 2 per cent of the total European retail value according to the EMCDDA. On the other hand, EMCDDA estimates suggest that heroin takes up around 28 per cent of the total retail market for drugs in Europe, whereas our estimates suggest that opioids only have a market share of 6 per cent on cryptomarkets. A possible explanation for these differences between ‘online’ and ‘offline’ markets may be that cryptomarket purchases typically require an element of planning, which may not suit the daily use of dependent heroin users. Furthermore, some substances lend themselves better to ‘stealth shipping’ than others. In our analysis, those vendors who self-reported that they are shipping from the Netherlands are used as a proxy for ‘Dutch vendors’. This could be an underestimate, as there are indications that some vendors operating from the Netherlands drive to Germany and ship from there. Some 40 per cent of all ‘Dutch
63 This upper-boundary estimate does not include revenues via potential stealth listings, as there is no information about their extent to draw any meaningful assumptions.
100 Internet-facilitated drugs trade RAND Europe listings’ were for ecstasy. Ecstasy-type drugs generate almost half of all revenues for ‘Dutch vendors’. ‘Dutch vendors’ are responsible for a quarter of all revenues generated from ecstasy-type drugs on the eight cryptomarkets analysed. These findings can be understood in the context of the pivotal position of the Netherlands in European ecstasy production. Contrary to observations made by various interviewees, however, our results suggest that the share of ‘Dutch vendors’ in cannabis sales is smaller than might be expected on the basis of the prominent role of the Netherlands in herbal cannabis production and transit of cannabis resin. Only 10 per cent of drugs revenues of ‘Dutch vendors’ is generated by cannabis. ‘Dutch vendors’ sell about 11 kg a month, just 2% per cent of the total global volume of cannabis traded on cryptomarkets. Previous research showed that clear net web shops primarily sell NPS. Hundreds different types of such designer drugs (often labelled as research chemicals) are offered for sale, including synthetic cannabinoids, opioids, tryptamines, and benzodiazepines. 2. In which volumes are the drugs offered? To what extent do these volumes refer towards wholesale or retail? (Sections 4.5 and 4.6)
Only 2 per cent of transactions analysed in this study exceeded $1,000, a majority of which we conclude were likely to be wholesale purchases. This small share of wholesale transactions, however, did generate about a quarter of the total drugs revenues on the markets analysed. The lion’s share of transactions on these cryptomarkets was generated by listings under $100, most likely to be for personal use. But these retail transactions generated only 18 per cent of total revenues. Most revenues were generated by listings priced between $100 and $500 (41 per cent). Bearing in mind the caveats of the analysis presented in this report, we found that a minimum of 475 kg cannabis was traded in a month on the analysed cryptomarkets, the bulk of which was offered in the price range of $100–$500 and higher than $1,000 (each 31 Per cent). Similar distributions were found for cocaine and MDMA powder, which were shipped in total volumes of 28 kg and 49 kg respectively. Similar to cryptomarkets, other studies have shown that clear net markets could also be used for wholesale purchases, both for business and social supply. The scale in which this is taken place, however, is unknown. 3. To what extent are goods and services offered in support of other activities in the drugs supply chain? (Section 4.7.1)
Products and services that might be used to support drug production, supply and use such as counterfeit IDs, financial products and services, or production equipment are listed on the cryptomarkets examined. They generate sales, albeit in negligible amounts in comparisons to drugs themselves. The total revenue generated by these products and services in January 2016 across the eight markets was about 0.2 per cent of the amount generated by drug sales. ‘Dutch vendors’ appear nearly absent in this business. 4. To what extent are the drugs offered in combination with other (legal or illegal) goods or services? If so, which ones? (Section 4.7.2)
Although it seems possible that drug vendors also sell goods and services that might be useful for drug dealers operating online or offline (e.g. money laundering), we found that cryptomarket vendors in our
101 RAND Europe Internet-facilitated drugs trade sample specialised either in the sale of drugs or in the sale of other types of products. The majority of vendors (58 per cent) sold drugs and nothing else, and that share was even higher for ‘Dutch vendors’ (83 per cent). It was relatively uncommon for vendors to sell drugs in combination with goods and services that are unrelated to drugs. ‘Dutch vendors’ on the analysed cryptomarkets almost exclusively specialise in drug sales, as only a small minority (7 per cent) did not sell drugs, compared to the overall share of non- drugs vendors (29 Per cent).
Cryptomarkets and other Internet-based marketplaces 5. How many cryptomarkets and other Internet-based marketplaces exist where drugs are traded? How do these relate to each other in terms of listings? (Section 4.2)
As part of this study, we identified about 50 live cryptomarkets and single-vendor shops on the dark web. As of mid-February, there were 19 active cryptomarkets with at least 400 listings each. The three largest markets, AlphaBay, Nucleus and Dreammarket, covered about 65 per cent of all listings. The eight markets scraped for this study had 105,811 listings, approximately 80 per cent of all listings across all cryptomarkets identified. Previous studies have highlighted the growing availability of NPS on the clear net. Various types of NPS are still legal and can be sold online, provided web shops indicate explicitly that they are not intended for human consumption. NPS web shops therefore typically label their merchandise as ‘research chemicals’ The number of web shops reporting to be selling NPS in the EU has grown from 69 in 2008 to 314 in 2011 and 651 in 2013. 6. To what extent do cryptomarkets and other Internet-based marketplaces put restrictions on the drugs trade? (Section 3.1.4)
The eight large cryptomarkets that were analysed have established rules, and most could be understood as seeking to reduce particularly third-party harm. Most marketplaces prohibited particular products and services from being listed by vendors for sale, such as child pornography, assassination services and banned weapons. Some had stated rules against blackmailing or ‘doxxing’ customers. And finally, some of these marketplaces explicitly encouraged participants in using security and encryption practices, with one stating that marketplace adjudication would be unavailable to participants not employing such practices. We have not come across any restrictions to sales to minors. 7. Which trends can we observe in the field of cryptomarkets and other Internet-based marketplaces where drugs are being traded? (Section 3.2)
We have observed a number of trends:
• A series of security failures, scams and law enforcement disruptions and interventions have impacted on the longevity of individual cryptomarkets: they had a shorter lifespan between introduction and going offline. Despite the importance of trust between vendors, buyers and administrators for to the success of cryptomarkets and their vendors, commentators reported declining levels of trust between these actors. Nevertheless, the environment of reduced trust did not appear to have prevented the drugs trade on online marketplaces, and new
102 Internet-facilitated drugs trade RAND Europe
innovations and developments appear to have arisen allowing trade to flourish in spite of these challenges. • Exit scam risk and fear of law enforcement take down have led some vendors to establish single-vendor shops and to encourage potential buyers to approach them via (encrypted) email or direfct messaging. • Some technical innovations implemented on cryptomarkets, aimed at reducing the risks to vendors and buyers for scams, have been noted in the literature and interviews. Though not yet widely adopted, multi-signature escrow requires sign-off from two out of three parties, which makes it impossible for one party to single-handedly retrieve the funds and disappear. • Decentralised markets that operate using a peer-to-peer system, while still in their infancy, have the potential to reduce the possibilities of law enforcement disruption and intervention, as it will be impossible to take the entire system down. 8. What are the possible trends that occur in terms of the number of vendors involved in drugs trade on the Internet and their listings? (Section 4.8)
Our results suggest that the number of cryptomarket drug vendors has more than doubled from around thousand in 2013 to more than 2,700 in January 2016. This is probably an overestimate as there is some potential for double-counting when identifying unique vendor profiles across marketplaces. Nevertheless, the total number of cryptomarket vendors has clearly grown since 2013. We have also observed a six-fold increase in the total number of listings since then. Our results suggest that 57 per cent of all listings offered drugs on cryptomarkets. This indicates that non-drugs listings have become more common since the early days of Silk Road, when analysis into that market found that drugs represented the vast majority of listings. Overall revenues generated by drugs sales on cryptomarkets in 2016, however, have only just doubled since 2013.
Shipping routes 9. From which countries do vendors operate primarily? (Section 5.1)
We undertook analysis to understand shipping routes via cryptomarkets and the role of the Netherlands in particular. Cryptomarket vendors appeared to be shipping from dozens of countries. To our knowledge, and that of the literature, cryptomarkets have primarily manifested themselves in the Anglo- Saxon world and Western Europe, but given their role in production, Asian countries (such as China and India) may also be fertile breeding ground for online drug sales. For this study we use vendors who self- report that they are shipping from the Netherlands as a proxy for ‘Dutch vendors’. Our data suggested that the Netherlands seems to play a prominent role in drugs trade facilitated by the cryptomarkets. We found 212 vendors that ‘ship from’ the Netherlands (13.4 vendors per million population). Most vendors appeared to be operating from the United States (890 or 2.8 per million population), followed by the United Kingdom (338 or 5.3 per million population), and Germany (225 or 2.8 per million population). Revenues to vendors operating from the Netherlands in the cryptomarkets analysed was 2.4 times higher than those from the United Kingdom and 4.5 higher than those from the United States.
103 RAND Europe Internet-facilitated drugs trade
Based on literature and interview data, sales of NPS via clear net web shops seemed to be less prominent in the Netherlands than in other European countries. The I-TREND study found 19 shops operating from the Netherlands, compared to 207 from the UK and 72 from Poland. 10. To which countries are vendors willing to ship? (Section 5.2)
Scraped cryptomarket data did not offer insight into the geographic locations of buyers. However, looking at vendors’ ‘willingness to ship to’ information suggests that the most common shipping route on markets analysed is from and to North America (almost $5m in revenues), mostly American vendors selling to American customers. The second most important route in our data, generating $2m in revenues, was shipped from European vendors and to European buyers, followed by shipping to and from Oceania (Australia and New Zealand). There were only two ‘Dutch vendors’ who exclusively served the domestic market. 11. Are there indications that the Netherlands is an important country of origin for drugs trade on the Internet? (Section 5.1 and 4.3 – 4.7)
‘Dutch vendors’ generated $1.1m and as such accounted for 7.8 per cent of total drug revenues from the eight markets monitored (9.1 per cent if prescription drugs and alcohol/tobacco were excluded). This makes the Netherlands the fifth largest ‘vendor country’, after the United States (35.9 per cent), United Kingdom (16.1 per cent), Australia (10.6 per cent) and Germany (8.4 per cent). Average revenues generated by Australian vendors was relatively high, probably because drugs tend to be more expensive there than in other countries. Compared to findings in 2013, the distribution of revenues across countries has not changed much with the exception of Australia, which has seen its share of revenues increase over the past three years. Australia also appeared to generate most revenues per vendor. This is in line with the vastly higher prices of drugs in Australia, which probably translates to higher prices per unit.
Actors involved in Internet-facilitated drugs trade 12. Which actors are involved in the trade of drugs on the Internet? (Chapter 6)
There is consensus in previous literature and interviews that five key actors are (knowingly) involved in Internet-facilitated drugs trade:
• Administrators have an executive management role on the marketplace and fulfil the role of treasurer. In terms of hierarchy, administrators sit at the top of cryptomarkets, and mostly have libertarian ideas for acting on these platforms. Administrators receive a commission for each sale finalised through the marketplace; • Developers are commissioned to carry out web design (and maintenance). Some anecdotal evidence shows that they are young, IT-savvy males who conduct this work on a freelance basis; • Moderators are marketplace members of staff, potentially receiving a salary for their services, which include assisting with site maintenance and customer support; • Vendors sell drugs and other goods via their vendor page on a marketplace or their own single-vendor market and subsequently ship them via postal services; and
104 Internet-facilitated drugs trade RAND Europe
• Buyers purchase drugs on vendors’ seller pages mostly in exchange for cryptocurrency (e.g. Bitcoins), followed by feedback or rating.
Other actors, who have a supporting role and may or may not be aware that they are involved in Internet- facilitated drugs trade include: cryptocurrency exchangers, Internet Service Providers, suppliers of legal goods and services (e.g. envelopes or precursors) and postal services. 13. What is known about the developers and administrators of such marketplaces and websites? (Chapter 6)
Apart from the information summarised under research question 12, and despite some anecdotal information from media reports, the data available for this study did not provide additional evidence on the characteristics of developers and administrators. 14. What can be said about the characteristics of vendors? (Section 6.2)
Based on limited, sometimes anecdotal, evidence from the literature, interviews and case file analysis it was found that vendors selling drugs on cryptomarkets seemed to be overwhelmingly young (under the age of 40), entrepreneurial, men from Anglo-Saxon countries or Western Europe with strong IT-skills. Arrest data partly confirm this, as 85 per cent of arrestees is male (when gender information is available) and their mean age is 33 years. Some vendors are buyers (consumers) of drugs as well. Although English is the dominant language on cryptomarkets, some vendors do communicate in their native language. Empirical research on vendors suggests that financial, libertarian and (perceptions of increased) safety motives underlie commencing selling drugs online. Vendors were a mix of professional dealers with close ties to production who consider Internet sales as an additional revenue stream and ‘newbies’ who thus far only sold drugs to friends. There were no studies identified in our literature review that provided information on the characteristics of vendors involved in clear net drugs trade. 15. How does the payment of Internet-based drugs trade proceed? (Section 3.1.2)
Drugs purchased on cryptomarkets are typically paid for using cryptocurrency (e.g. bitcoins), but some markets even allow credit and debit cards, via a centralised escrow system: the transaction amount is held in deposit by the market place until the buyer confirms receipt by providing positive feedback. Vendors typically use crypto-exchangers to money launder their crypto-currencies. Successful vendors may be allowed to ‘finalise early’ (FE) ensuring direct payment without funds first being held in escrow. Vendor and exit scams have given rise to alternative payment mechanism, such as those based on multi-signature escrow. Payment on online pharmacies or NPS web shops on the clear net may proceed via bitcoins, credit or debit cards, or online bank transfers. 16. What is the modus operandi in the shipping of drugs? (Section 3.1.5) Vendors typically use legitimate postal services to ship drug orders to their customers. The ‘stealth factor’ determines the extent to which the true contents of the parcel have been concealed, for example, using the look-and-feel of other legitimate retail products. ‘Dutch vendors’ have been reported to travel to Belgium
105 RAND Europe Internet-facilitated drugs trade or Germany to avoid stringent scanning practices in destination countries (particularly Australia and the United States) that are extra alert to parcels sent from the Netherlands. 17. What can be said about (the development of) the size of the population of customers/buyers in the Netherlands? (Section 5.2.2) Little evidence is available from previous studies about Dutch consumers who buy drugs via the Internet, and the cryptomarket data collected for this study do not offer any insights into Dutch buyers. Almost no listings were posted by ‘Dutch vendors’ that targeted only customers in the Netherlands. The limited number of studies identified in our review of the literature that reported on consumers buying drugs online found little to no evidence that Dutch customers were using the Internet to buy drugs. Demand side studies indicated that a small percentage of Dutch drug users purchase drugs online, although these studies (often self-reported surveys) did not distinguish between purchases on cryptomarkets and the clear net. As such, more research will be needed to more precisely estimate the population of customers in the Netherlands who purchase drugs online. A previous study looking at the number of online NPS shops based in the Netherlands, suggested that the market for purchasing NPS online is smaller in the Netherlands than in some other European countries. 18. What can be said about the characteristics (age, criminal antecedents) of the customers/buyers? Which trends are occurring? (Section 6.3) Similar to vendors, according to previous research and interviewees, buyers tended to be relatively young, educated and digitally literate males from Anglo-Saxon and (other) European countries. The mean age of people arrested in relation to buying drugs on cryptomarkets was 25. Many seemed to be recreational users (some considered themselves ‘psychonauts’) who used drugs previously and were able to plan their consumption in advance. The motives for buying drugs online were similar to those found among vendors: (perceptions of) safety and quality when buying drugs online to the ease of speedy and stealth delivery. For some buyers, cryptomarkets replaced their local dealer, while others still relied on offline sources as well. 19. What is the modus operandi in the buying and receiving of drugs? (Section 6.3.3) Section 6.2 provided insight in the various modus operandi of buyers reported in previous research and by experts interviewed for this study. Some highlights included:
• Although cryptomarkets potentially facilitate the internationalisation of drugs retail markets, allowing buyers to purchase drugs from vendors around the world, some evidence suggests that, all other things being equal, buyers preferred to purchase drugs online from domestic sellers; • There have been examples on forums and seller Q&A pages where buyers could find information on techniques to avoid detection, such as the use of pseudonyms, having items delivered at addresses other than their home address and shipping of drugs in small quantities; • Trust in vendors seemed more important than loyalty to marketplaces; and
106 Internet-facilitated drugs trade RAND Europe
• A small share (between 2 and 6 per cent) of the transactions on the cryptomarkets analysed was made in wholesale quantities, suggesting that some buyers were dealers or social distributers.
Avenues for intervention 20. Which broad strategies are available to law enforcement in the detection and intervention of the Internet-facilitated drugs trade? (Section 7.2) Based on interview and literature data, we identified four potential strategies that are available to law enforcement in the detection and intervention of Internet-facilitated drugs trade:
1. Traditional investigation techniques applied in the drug chain (e.g. surveillance, undercover operations); 5. Postal detection and interception (e.g. collaboration between law enforcement agencies and postal services); 6. Online detection (e.g. big data techniques, monitoring of online marketplaces, tracking money flows); and 7. Online disruption (e.g. taking down online marketplaces).
21. Which barriers do law enforcers face in the Netherlands in detection and prosecution of drugs trade on the Internet? (Section 7.2) For each of these four strategies of detection and intervention barriers were identified by interviews and in the literature. Section 7.2 provides a detailed overview of barriers for each strategy, but some cross-cutting challenges were:
• Resources and capacity; • Attracting, developing and maintaining skills; • Dealing with multiple jurisdictions and managing internationally competing interests; • Privacy protection and other legal restrictions to monitoring online behaviour, screening parcels, or traditional surveillance; • Challenges related to encryption, attribution and fluctuation; and • The resilience of online communities and illicit activities. 22. What were the consequences of bringing down marketplaces? To what extent did any substitution effects occur? (Section 7.2.4) Anecdotal evidence from the literature suggests that law enforcement activities have had an impact on confidence in cryptomarkets, but it has been suggested that the negative impact on trust of scams within markets might be greater than what law enforcement action could achieve. Previous studies have found that the main consequence of bringing down marketplaces has been the migration of vendors and customers to other existing cryptomarkets or to new marketplaces, and the implementation of innovative solutions by some cryptomarkets to prevent losses or maintain anonymity.
107
References
Advisory Council on the Misuse of Drugs. 2011. ‘Consideration of the Novel Psychoactive Substances (‘Legal Highs’).’ As of 12 June 2016: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/119139/acmdnps201 1.pdf
Aldridge, J. & D. Décary-Hétu. 2014. ‘Not an ‘Ebay for Drugs’: The cryptomarket “Silk Road” as a paradigm shifting criminal innovation.’ As of 12 February 2016: http://ssrn.com/abstract=2436643
Aldridge, J. & D. Décary-Hétu. 2015a. ‘Cryptomarkets: The Dark Net as Online Market Innovation.’ Final Report to NESTA, UK.
Aldridge, J. & D. Décary-Hétu. 2015b. ‘A response to Dolliver's "Evaluating drug trafficking on the Tor Network: Silk Road 2, the sequel”.’ International Journal on Drug Policy 26 (11): 1124-1125. doi:10.1016/j.drugpo.2015.05.017
Aldridge, J. & D. Décary-Hétu. 2016a. ‘Hidden Wholesale: The drug diffusing capacity of online drug cryptomarkets.’ The International Journal of Drug Policy. doi: 10.1016/j.drugpo.2016.04.020.
Aldridge, J. & D. Décary-Hétu. 2016b. ‘Cryptomarkets and the future of illicit drug markets.’ In The Internet and drug markets, edited by EMCDDA, 23-32. Lisbon: EMCDDA.
Aldridge, J. & R. Askew. 2016. ‘When drug dealers can advertise: how drug cryptomarkets enable drug dealers to advertise.’ Presented at the 10th Annual Conference of the International Society for the Study of Drug Policy, Sydney.
Aldridge, J., A. Stevens, & M. Barratt. 2016. ‘A research agenda for assessing harms and benefits related to cryptomarket drug trading.’ Presented at the 10th Annual Conference of the International Society for the Study of Drug Policy, Sydney.
APAIC. 2016. The Asia & Pacific Amphetamine-Type Stimulants Information Centre – New Psychoactive Substances. Website. As of 21 June 2016: http://www.apaic.org/index.php?option=com_content&view=article&id=369&Itemid=800
Bancroft, A. & P.S. Reid. 2015. ‘Concepts of illicit drug quality among darknet market users: Purity, embodied experience, craft and chemical knowledge.’ International Journal of Drug Policy. doi:10.1016/j.drugpo.2015.11.008.
Barratt, M.J. 2012. ‘Silk Road: eBay for drugs.’ Addiction 107: 683-683. doi:10.1111/j.1360- 0443.2011.03709.x
109 RAND Europe Internet-facilitated drugs trade
Barratt, M., J.A. Ferris, & A.R. Winstock. 2016a. ‘Safer scoring? Cryptomarkets, social supply and drug market violence.’ The International Journal of Drug Policy. doi:10.1016/j.drugpo.2016.04.019
Barratt, M., S. Lenton, A. Maddox, & M. Allen. 2016b. ‘‘What if you live on top of a bakery and you like cakes?’—Drug use and harm trajectories before, during and after the emergence of Silk Road.’ The International Journal of Drug Policy S0955-3959 (16): 30098-6. doi:10.1016/j.drugpo.2016.04.006.
Barratt, M.J., J. Ferris, & A. Winstock. 2014. ‘Use of Silk Road, the online drug marketplace, in the United Kingdom, Australia and the United States.’ Addiction 109 (5): 774–783. doi:10.1111/add.12470
Bartlett, J. 2015. The Dark Net: Inside the Digital Underworld. Brooklyn: Melville House.
Basu, G. 2014. ‘The strategic attributes of transnational smuggling: Logistics flexibility and operational stealth in the facilitation of illicit trade.’ Journal of Transportation Security 7(2): 99–113.
BBC. 2013. ‘FBI arrests Silk Road drugs site suspect.’ BBC, 2 October 2013. As of 12 June 2016: http://www.bbc.co.uk/news/technology-24373759
BBC. 2013. ‘Instagram blocks some drugs advert tags after BBC probe.’ BBC, 7 November. As of 28 April 2016: http://www.bbc.com/news/technology-24842750
Benschop, A., T. Nabben, & D.J. Korf.2015. Antenne 2014: trends in alcohol, tabak en drugs bij jonge Amsterdammers. Amsterdam: Rozenberg Publishers.
Bieleman, B., R. Mennes, & M. Sijtstra. 2015. Coffeeshops in Nederland 2014: Aantallen coffeeshops en gemeentelijk beleid 1999-2014. Groningen-Rotterdam: Bureau Intraval.
Bigdeli, I., O. Corazza, Z. Aslanpour, & F. Schifano. 2013. ‘Novel Psychoactive Substances (NPS): a Study on Persian Language Websites.’ Iranian Journal of Public Health 42 (5): 511–515.
Bitcoinhelp.net. 2016. ‘Bitcoin Price Chart with Historic Events.’ Bitcoinhelp.net, 3 November. As of 12 June 2016: https://bitcoinhelp.net/know/more/price-chart-history
Boivin, R. 2014. ‘Risks, prices, and positions: A social network analysis of illegal drug trafficking in the world-economy.’ International Journal of Drug Policy 25 (2): 235-243. doi:10.1016/j.drugpo.2013.12.004
Borromeo, Leah. 2016. ‘Drug dealers using Instagram and Tinder to find young customers.’ The Guardian, 7 April. As of 12 June 2016: http://www.theguardian.com/sustainable- business/2016/apr/07/drug-dealers-instagram-tinder-young-customers?CMP=twt_gu
Broséus, J., D. Rhumorbarbe, C. Mireault, V. Ouellette, F. Crispino, & D. Décary-Hétu. 2016. ‘Studying illicit drug trafficking on Darknet markets: structure and organisation from a Canadian perspective.’ Forensic Science International 264: 7-14. doi:10.1016/j.forsciint.2016.02.045
Buwalda, M. & N. Kwakman. 2014. ‘Het ontwerp wetsvoorstel Computercriminaliteit III.’ Ars Aequi 63(1): 9-17. As of 12 June 2016: http://www.rug.nl/research/portal/files/13789865/AA20140009.pdf
110 Internet-facilitated drugs trade RAND Europe
Buxton, J. & T. Bingham. 2015. ‘The Rise and Challenge of Dark Net Drug Markets.’ Global Drug Policy Observatory, Swansea University, Policy brief 7. As of 12 June 2016: http://www.drugsandalcohol.ie/23274/1/Darknet%20Markets.pdf
Cadet-Taïrou, A., M. Gandilhon, E. Lahaie, M. Martinez, S. Dambélé, & S. Saïd. 2013. Markets, products, users: recent trends (2011-2012). Saint-Denis: Observatoire Français des Drogues et des toxicomanies.
Caudevilla, F., M. Ventura, I. Fornis, M. Barratt, C. Vidal, C. Iladanosa, P. Quintana, A. Muñoz & N. Calzada. 2016. ‘Results of an international drug testing service for cryptomarket users.’ The International Journal of Drug Policy. doi:10.1016/j.drugpo.2016.04.017
Cavazos-Rehg, P., M. Krauss, R. Grucza, & L. Bierut. 2014, ‘Characterizing the followers and tweets of a marijuana-focused Twitter handle.’ Journal of Medical Internet Research 16 (6): e157. doi:10.2196/jmir.3247
Chen, A. 2011. ‘The Underground Website Where You Can Buy Any Drug Imaginable.’ Gawker.com, 1 June 2011. As of 12 June 2016: http://gawker.com/the-underground-website-where-you-can-buy- any-drug-imag-30818160
Cho, Y.I., T.P. Johnson, & M. Fendrich. 2001. ‘Monthly variations in self-reports of alcohol consumption.’ Journal of Studies on Alcohol 62 (2): 268-272. doi:10.15288/jsa.2001.62.268
Christin, N. 2013. ‘Traveling the Silk Road: a measurement analysis of a large anonymous online marketplace.’ Paper presented at the International World Wide Web Conference (IW3C2), 13– 17 May 2013, Rio de Janeiro, Brazil. As of 12 June 2016: http://www.andrew.cmu.edu/user/nicolasc/publications/Christin-WWW13.pdf.
Ciancaglini, V., M. Balduzzi, R. McArdle, & M. Rösler. 2015. ‘Below the Surface: Exploring the Deep Web.’ Trend Micro Incorporated. As of 12 June 2016: https://www.trendmicro.com/cloud- content/us/pdfs/security-intelligence/white-papers/wp_below_the_surface.pdf
Council of the European Union. 2010. Council Conclusions of 25 October 2010 on the creation and implementation of an EU Policy Cycle for organised and serious international crime (doc. 15358/10).
Corazza, O., A. Sulaf, S. Malekianragheb, B. Mitra Naderi, I. Bigdeli, Z. Aslanpour, & F. Schifano. 2014. ‘Monitoring novel psychoactive substances allegedly offered online for sale in Persian and Arabic languages.’ International Journal of Drug Policy 25 (4):724-726. doi:10.1016/j.drugpo.2014.05.005
Cox, J. 2015a. ‘Some Brazen Drug Marketplaces Are Operating on the Normal Web.’ Motherboard, 18 August. As of 12 June 2016: http://motherboard.vice.com/read/some-brazen-drug-sites-are-now- operating-on-the-normal-web
Cox, J. 2015b. The Dark Web’s Biggest Marketplace Is Going on Hiatus. Motherboard, 26 August. As of 12 June 2016: http://motherboard.vice.com/read/the-dark-webs-biggest-marketplace-goes-on-hiatus
Cox, J. 2016a. ‘Reputation is everything: the role of ratings, feedback and reviews in cryptomarkets.’ In The Internet and drug markets, edited by EMCDDA, 49-54. Lisbon: EMCDDA.
111 RAND Europe Internet-facilitated drugs trade
Cox, J. 2016b. ‘Staying in the shadows: the use of bitcoin and encryption in cryptomarkets.’ In The Internet and drug markets, edited by EMCDDA, 41-47. Lisbon: EMCDDA.
Cyber Experts Blog at National Cybersecurity Institute. 2015. ‘Encryption: The Backbone of Cybersecurity Strategies.’ As of 12 June 2016: http://www.nationalcybersecurityinstitute.org/editorials/encryption-the-backbone-of-cybersecurity- strategies/
Dargan, P.I. & D.M. Wood. 2012, ‘Recreational drug use in the Asia Pacific region: improvement in our understanding of the problem through the UNODC Programmes.’ Journal of Medical Toxicology, 8: 295–299
Décary-Hétu, D. & J. Aldridge. 2013. DATACRYPTO: The Dark Net Crawler and Scraper.
Décary-Hétu, D., M. Paquet-Clouston, & J. Aldridge. Forthcoming. ‘Going international. Risk taking and the willingness to ship internationally among drug cryptomarket vendors.’ International Journal of Drug Policy.
DeepDotWeb. 2015. ‘Outlaw market V5 is up.’ DeppDotWeb, 17 December. As of 12 June 2016: https://www.deepdotweb.com/2015/12/17/outlaw-market-v5-is-up/
DeepDotWeb. 2016. ‘Interview With Valhalla (Silkkitie) Admin.’ As of 12 June 2016: https://www.deepdotweb.com/2015/10/16/interview-with-valhalla-silkkitie-admin/
Deepdotweb. 2016a. ‘Updated: List of Dark Net Markets (Tor & I2P).’ As of 12 June 2016: https://www.deepdotweb.com/2013/10/28/updated-llist-of-hidden-marketplaces-tor-i2p/
DeepDotWeb. 2016b. ‘East India Company: Another Exit Scam?’ DeepDotweb, 4 January. As of 12 June 2016: https://www.deepdotweb.com/2016/01/04/east-india-company-another-exit/
DeepDotWeb. 2016c. ‘Nucleus Is Gone: These Are The Top Alternatives!’ DeepDotWeb, 20 April. As of 12 June 2016: https://www.deepdotweb.com/2016/04/20/nucleus-top-10-alternatives/
DeepDotWeb. 2016d. ‘Vendor shops.’ DeepDotWeb, As of 12 June 2016: https://www.deepdotweb.com/marketplace-directory/categories/vendor-shops/
DeepDotWeb. 2016e. ‘The Future of the Markets.’ DeepDotWeb, 16 January. As of 12 June 2016: https://www.deepdotweb.com/2016/01/07/the-future-of-the-markets/ [originally submitted to Reddit by MLP_is_my_OPSEC on 6 January 2016.]
Del Río, M. C., C. Prada, & F.J. Alvarez. 2002. ‘Drinking habits throughout the seasons of the year in the Spanish population.’ Journal of Studies on Alcohol 63 (5): 577-580.
Deluca, P., Z. Davey, O. Corazza, L. Di Furia, M. Farre, L. Flesland, M. Mannonen, A. Majava, T. Peltoniemi, & M. Pasinetti. 2012. ‘Identifying emerging trends in recreational drug use; outcomes from the Psychonaut Web Mapping Project.’ Progress in Neuro-Psychopharmacology and Biological Psychiatry 39 (2): 221-226. doi:10.1016/j.pnpbp.2012.07.011
Department of Justice. 2014. ‘Dutch Man To Plead Guilty To Selling Illegal Drugs For Bitcoins Worth Millions On Shuttered Silk Road Website.’ Press release, U.S. Attorney’s Office Northern District of
112 Internet-facilitated drugs trade RAND Europe
Illinois, 24 April. As of 12 June 2016: https://www.justice.gov/usao-ndil/pr/dutch-man-plead-guilty- selling-illegal-drugs-bitcoins-worth-millions-shuttered-silk
Digital Citizens Alliance. 2014a. ‘Busted, but not broken. The state of Silk Road and the Darknet Marketplaces. A Digital Citizens Alliance Investigative Report (April 2014).’ As of 12 June 2016: https://media.gractions.com/314A5A5A9ABBBBC5E3BD824CF47C46EF4B9D3A76/5f8d4168- c36a-4f78-b048-f5d48b18dc0a.pdf
Digital Citizens Alliance. 2014b. ‘Darknet Marketplace Watch - Monitoring Sales of Illegal Drugs on the Darknet (December 2014).’ As of 12 June 2016: http://www.digitalcitizensalliance.org/cac/alliance/content.aspx?page=Darknetq42014
Dolliver, D.S. & J.L. Kenney. 2016. ‘Characteristics of Drug Vendors on the Tor Network: A Cryptomarket Comparison.’ Victims & Offenders. An International Journal of Evidence-based Research, Policy, and Practice 00: 1-21. doi:10.1080/15564886.2016.1173158
Dolliver, D.S. 2015. ‘Evaluation drug trafficking on the Tor Network: Silk Road 2, the sequel.’ International Journal of Drug Policy 26 (11): 1113–1123. doi:10.1016/j.drugpo.2015.01.008
Drugabuse.com. n.d. ‘Coalition against drugs. “Insta-Gram, Instahigh, Instabusted.”’ As of 12 June 2016: http://drugabuse.com/featured/instagram-drug-dealers/
Druginfo. 2015. ‘New psychoactive substances (synthetics) facts.’ As of 12 June 2016:http://www.druginfo.adf.org.au/drug-facts/legal-highs
DrugScope. 2014. ‘Business as usual? A status report on new psychoactive substances (NPS) and ‘club drugs’ in the UK.’ As of 12 June 2016: https://drugscopelegacysite.files.wordpress.com/2015/07/businessasusual.pdf
EMCDDA & Europol. 2013. ‘EU Drug Markets Reports: A strategic analysis.’ As of 12 June 2016: http://www.emcdda.europa.eu/attachements.cfm/att_194336_EN_TD3112366ENC.pdf
EMCDDA & Europol. 2015. ‘EU Drug Markets Report: In-Depth Analysis.’ Lisbon: EMCDDA, Europol.
EMCDDA & Europol. 2016. ‘EU Drug Markets Report: In-Depth Analysis.’ Lisbon: EMCDDA, Europol.
EMCDDA. 2009. ‘Annual report 2009: The state of the drug problem in Europe.’ Lisbon: EMCDDA.
EMCDDA. 2011a. ‘2011 Annual report on the state of the drugs problem in Europe.’ Lisbon: EMCDDA.
EMCDDA. 2011b. ‘Online sales of new psychoactive substances / 'legal highs': summary of results from the 2011 multilingual snapshots.’ Lisbon: EMCDDA.
EMCDDA. 2015a. ‘The Internet and Drug Markets. Summary of results from an EMCDDA Trendspotter study.’ As of 12 June 2016: http://www.emcdda.europa.eu/publications/technical- reports/internet-drug-markets
113 RAND Europe Internet-facilitated drugs trade
EMCDDA. 2015b. ‘Summary: Drug market dynamics in Europe: global influences and local differences.’ As of 12 June 2016: http://www.emcdda.europa.eu/publications/edr/trends- developments/2015/online/summary
EMCDDA, 2016a. ‘European Drug Report. Trends and developments,’ Lisbon: EMCDDA. As of 12 June 2016: http://www.emcdda.europa.eu/publications/edr/trends-developments/2016
EMCDDA. 2016b. ‘The Internet and drug markets, EMCDDA Insights 21.’ Lisbon: EMCDDA.
Europol. 2014. ‘Global action against dark markets on TOR network.’ As of 12 June 2016: https://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network
Europol. 2014. ‘The Internet Organised Crime Threat Assessment (iOCTA).’ As of 12 June 2016: https://www.europol.europa.eu/content/internet-organised-crime-threat-assesment-iocta
Europol. 2015. ‘The Internet Organised Crime Threat Assessment (IOACTA).’ As of 12 June 2016: https://www.europol.europa.eu/content/internet-organised-crime-threat-assessment-iocta-2015
Federal Ministry of the Interior. 2015. ‘JICDT-VM Darknet Project.’ As of 12 June 2016: http://www.bmi.gv.at/cms/BK/publikationen/files/552015_Broschre_Darknet_Project_Web.pdf
Franklin, J., Paxson, V., Perrig, A., Savage, S. 2007. ‘An inquiry into the nature and causes of the wealth of internet miscreants.’ In: Proceedings of the 14th ACM Conference on Computer and Communications Security. As of 19 June 2016: http://dl.acm.org/citation.cfm?id=1315292
Global Drugs Survey. 2015. ‘The Global Drug Survey 2015 findings.’ As of 12 June 2016: http://www.globaldrugsurvey.com/the-global-drug-survey-2015-findings/
Gonzalez, D., Ventura, M., Caudevilla, F., Torrens, M. & M. Farre. 2013. ‘Consumption of new psychoactive substances in a Spanish sample of research chemical users.’ Human Psychopharmacology 28 (4): 332–340. doi:10.1002/hup.2323
Gordon, S.M., Forman, R.F. & C. Siatkowski. 2006. ‘Knowledge and use of the Internet as a source of controlled substances.’ Journal of Substance Abuse Treatment 30 (3): 271–274.
Greenberg, Andy. 2016. ‘The Silk Road’s dark-web dream is dead’. Wired, 14 January, As of 12 June2016: https://www.wired.com/2016/01/the-silk-roads-dark-web-dream-is-dead/
Guadamuz, A. & C. Marsden. 2015. Blockchains and Bitcoin: Regulatory responses to cryptocurrencies. First Monday 20 (12). As of 12 June 2016: http://firstmonday.org/ojs/index.php/fm/article/view/6198/5163
Gwern. 2016. Tor Black-Market-related Arrests. As of 12 June 2016: https://www.gwern.net/Black-market%20arrests
Hillebrand, J., D. Olszewski, & R. Sedefov. 2010. ‘Legal Highs on the Internet.’ Substance Use & Misuse 45 (3):330-340. doi:10.3109/10826080903443628.
Hoe, S. C., M. Kantarcioglu, & A. Bensoussan, A. 2012. ‘A game theoretical analysis of lemonizing cybercriminal black markets.’ In Decision and Game Theory for Security, edited by J. Grossklags and J. Walrand, 60-77. Berlin Heidelberg: Springer.
114 Internet-facilitated drugs trade RAND Europe
Home Office. 2014. Drug misuse: findings from the 2013 to 2014 Crime Survey for England and Wales. London: Home Office.
Hussain, F. 2015. ‘Feds use Instagram to arrest 350 drug dealers.’ Daily Pakistan, 19 August. As of 12 June 2016: http://en.dailypakistan.com.pk/world/Internet-slang-feds-use-instagram-to-arrest-350- drug-dealers-145/
Hutchings, A., R. Clayton, & R. Anderson. in press. ‘Taking Down Websites to Prevent Crime.’ Toronto: eCrime. As of 12 June 2016: https://www.cl.cam.ac.uk/~ah793/papers/2016takedown.pdf
Interpol. 2015. ‘Interpol Darknet training shines light on underground criminal activities.’ As of 12 June 2016: http://www.interpol.int/News-and-media/News/2015/N2015-108
Jones, A.L. 2002. ‘Legal ‘highs’ available through the Internet-implications and solutions?’ QJM: An International Journal of Medicine 103 (7): 535-536. As of 12 June 2016: http://ro.uow.edu.au/cgi/viewcontent.cgi?article=1183&context=medpapers
Katsuki, T., T.K. Mackey, & R. Cuomo. 2015. ‘Establishing a Link Between Prescription Drug Abuse and Illicit Online Pharmacies: Analysis of Twitter Data.’ Journal of Medical Internet Research 17 (12): e280. doi:10.2196/jmir.5144
KLPD. 2013. Witwassen. Criminaliteitsbeeldanalyse 2012. Driebergen: Korps landelijke politiediensten.
Kooistra, Sybren, & Jeroen Trommelen. 2014. ‘Hoe online coffeeshops een miljoenenomzet draaien.’ Volkskrant, 27 September 2014, 06:00. As of 12 February 2016: http://www.volkskrant.nl/vk/nl/2686/Binnenland/article/detail/3757208/2014/09/27/Hoe-online- coffeeshops-een-miljoenenomzet-draaien.dhtml
Koops, B-J., & M. Goodwin. 2014. ‘Cyberspace, the cloud, and cross-border criminal investigation: the limits and possibilities of international law.’ Tilburg/Den Haag: Tilburg University - TILT Tilburg Institute for Law, Technology, and Society/ WODC.
Krauss, M.J., S.J. Sowles, S. Mylvaganam, K. Zewdie, L.J. Bierut, & P.A. Cavazos-Rehg (2015) ‘Displays of dabbing marijuana extracts on YouTube.’ Drug & Alcohol Dependence 155: 45–51. doi:10.1016/j.drugalcdep.2015.08.020
Lahaie, E., M. Martinez, & A. Cadet-Taïrou. 2013. ‘New psychoactive substances and the Internet: current situations and issues.’ OFDT Tendancies 84: 1-8. As of 12 June 2016: http://en.ofdt.fr/publications/tendances/new-psychoactive-substances-and-Internet-tendances-84- january-2013/
Lai, F. Y., P.K. Thai, J. O'Brien, C. Gartner, R. Bruno, B. Kele, B., C. Ort, J. Prichard, P. Kirkbride, W. Hall, S. Carter & J.F. Mueller. 2013. ‘Using quantitative wastewater analysis to measure daily usage of conventional and emerging illicit drugs at an annual music festival.’ Drug and Alcohol Review 32 (6): 594-602. doi:10.1111/dar.12061
Lavorgna, A. 2014. ‘Internet-mediated drug trafficking: towards a better understanding of new criminal dynamics.’ Trends in Organized Crime 17 (4): 250–270. doi:10.1007/s12117-014-9226-8
115 RAND Europe Internet-facilitated drugs trade
Lavorgna, A. 2016. ‘How the use of Internet is affecting drug trafficking practices.’ In The Internet and drug markets, edited by EMCDDA, 85-92. Lisbon: EMCDDA.
Levin, Dan. 2015. ‘In China, Illegal Drugs Are Sold Online in an Unbridled Market.’ The New York Times, 21 June. As of 12 June2016: http://www.nytimes.com/2015/06/22/world/asia/in-china- illegal-drugs-are-sold-online-in-an-unbridled-market.html?_r=2
Lewman, A. 2016. ‘Tor and links with cryptomarkets.’ In The Internet and drug markets, edited by EMCDDA, 33-40. Lisbon: EMCDDA.
Mackey, T.K. & B.A. Liang. 2013. ‘Global Reach of Direct-to-Consumer Advertising Using Social Media for Illicit Online Drug Sales.’ Journal of Medical Internet Research 15 (5): e105. doi:10.2196/jmir.2610
Maddox, A., M.J., Barratt, M. Allen, & S. Lenton. 2016. ‘Constructive activism in the dark web: cryptomarkets and illicit drugs in the digital ‘demimonde’.’ Information, Communication & Society 19 (1):111-126. doi:10.1080/1369118X.2015.1093531
Mahapatra, Ananya & Pawan Sharma. 2016. ‘Internet snapshot survey: A novel methodology to monitor novel psychotropic substances and its need in Asia’, Asian Journal of Psychiatry 21: 7-8. doi.org/10.1016/j.ajp.2016.01.014.
Martin, J. 2014a. Drugs on the dark net: how cryptomarkets are transforming the global trade in illicit drugs. London: Palgrave Macmillan.
Martin, J. 2014b. ‘Lost on the Silk Road: online drug distribution and the ‘cryptomarket.’ Criminology and Criminal Justice 14 (3): 351–367. doi:10.1177/1748895813505234
Martinez, M., Kmetonyova, D. & V. Belackova. 2016. A method for exploring the number of online shops selling new psychoactive substances: initial I-TREND project results. In The Internet and drug markets, edited by EMCDDA, 97-106. Lisbon: EMCDDA.
Maxwell, S. & D. Webb 2008. Internet pharmacy: a web of mistrust? British Journal of Clinical Pharmacology 66 (2): 196-198.doi:10.1111/j.1365-2125.2008.03215.x
May, T. & M. Hough. 2004. ‘Drug markets and distribution systems.’ Addiction Research and Theory 12 (6): 549-563.
Micheals, Olivier. 2014 ‘It’s Still Really Easy to Buy Drugs on Instagram.’ Ryot.org. As of 12 June 2016: http://sandbox.ryot.org/still-easy-buy-drugs-on-instagram-dont-experiment/809265
Morselli, C., D. Decary-Hetu, M. Paquet-Clouston, & J. Aldridge. Under review. What Am I Going To Do, Shoot Him? Conflict Management in the Age of Drug Cryptomarkets, Journal of Conflict Resolution.
Mounteney, J., P. Griffiths, & L. Vandam. 2016. ‘What future for Internet drug markets?’ In The Internet and drug markets, edited by EMCDDA, 127-134. Lisbon: EMCDDA.
116 Internet-facilitated drugs trade RAND Europe
Mounteney, J., A. Oteo, & P. Griffiths. 2016. ‘The Internet and drug markets: shining a light on these complex and dynamic systems.’ In: The Internet and drug markets, edited by EMCDDA, 127-133. Lisbon: EMCDDA.
Munksgaard,. J. Demant, & G. Branwen. 2016. ‘A replication and methodological critique of the study.’ International Journal of Drug Policy. doi:10.1016/j.drugpo.2016.02.027
Nabben, T., Benschop, A., & D. Korf. 2014. Antenne 2013: Trends in alcohol, tabak en drugs bij jonge Amsterdammers. Rozenberg Publishers: Amsterdam.
National Institute on Drug Abuse. 2014a. ‘What are opioids?’ As of 01 June 2016: https://www.drugabuse.gov/publications/research-reports/prescription-drugs/opioids/what-are- opioids
National Institute on Drug Abuse. 2014b. ‘What are stimulants?’ As of 01 June 2016: https://www.drugabuse.gov/publications/research-reports/prescription-drugs/stimulants/what-are- stimulants
Nizar, H., P.I. Dargan, & D.M. Wood. 2015. ‘Using Internet Snapshot Surveys to Enhance Our Understanding of the Availability of the Novel Psychoactive Substance 4-Methylaminorex and 4,4′- Dimethylaminorex.’ Journal of Medical Toxicology 11 (1): 80–84. doi:10.1007/s13181-014-0425-0
NOS. 2016a. ‘Duitse politie pakt Nederlanders met 100,000 ecstasy-pillen.’ NOS, 21 January. As of 12 June 2016: http://nos.nl/artikel/2081789-duitse-politie-pakt-nederlander-met-100-000-ecstasy- pillen.html
NOS. 2016b. ‘Deze partydrug wordt steeds vaker geslikt.’ NOS, 2 May. As of 12 June 2016: http://nos.nl/op3/artikel/2102770-deze-partydrug-wordt-steeds-vaker-geslikt.html
Openbaar Ministerie. 2015. ‘In hoger beroep tot 7 jaar cel geëist voor online drugs- en wapenhandel 11 mei 2015, Ressortsparket.’ As of 12 June 2016: https://www.om.nl/vaste- onderdelen/zoeken/@89235/hoger-beroep-7-jaar/
OpenBazaar. 2016. OpenBazaar is open for Business. Blog post. As of 12 June 2016: https://blog.openbazaar.org/openbazaar-is-open-for-business/
Ormsby, Eileen. 2016. ‘Silk Road: insights from interviews with users and vendors.’ In The Internet and drug markets, edited by EMCDDA, 61-68. Lisbon: EMCDDA.
Orsolini, L., G. Francesconi, D. Papanti, A. Giorgetti, & F. Schifano. 2015. ‘Profiling online recreational/prescription drugs' customers and overview of drug vending virtual marketplaces.’ Human Psychopharmacology: Clinical and Experimental 30 (4): 302-318. doi:10.1002/hup.2466
Phelan, Matthew. 2014 ‘You Could Be Selling Drugs Anonymously on Instagram in a Couple Hours.’ Black Bag, 13 September. As of 12 June 2016: http://blackbag.gawker.com/you-could-be-selling- drugs-anonymously-on-instagram-in-1634327114
Phelps, A. & A. Watt. 2014. ‘I shop online – recreationally! Internet anonymity and Silk Road enabling drug use in Australia.’ Digital Investigation 11 (4): 261-272. doi:10.1016/j.diin.2014.08.001
117 RAND Europe Internet-facilitated drugs trade
Raeesi, R. 2015. ‘The Silk Road, Bitcoins and the Global Prohibition Regime on the International Trade in Illicit Drugs: Can this Storm Be Weathered?’ Glendon Journal of International Studies 8 (2): 1-20. As of 20 April 2016: http://gjis.journals.yorku.ca/index.php/gjis/article/view/38935/36402
Reddit. 2015. ‘Darknet future: dead drops.’ As of 12 June 2016: https://www.reddit.com/r/DarkNetMarkets/comments/3cklw1/darknet_future_dead_drops/.compact
Rijksoverheid. 2015. Wetsvoorstel Computercriminaliteit bij Tweede Kamer ingediend. As of 27 April 2016: https://www.rijksoverheid.nl/actueel/nieuws/2015/12/22/wetsvoorstel-computercriminaliteit-bij- tweede-kamer-ingediend
Robinson, O.C. 2014. ‘Sampling in Interview-Based Qualitative Research: A Theoretical and Practical Guide.’ Qualitative Research in Psychology 11 (1): 25-41. doi:10.1080/14780887.2013.801543.
Scammell, Lynda & Alessandra Bo. 2016. ‘Online supply of medicines to illicit drug markets: situation and responses.’ In The Internet and drug markets, edited by EMCDDA, 107-114. Lisbon: EMCDDA.
Schifano, F., P. Deluca, A. Baldacchino, T. Peltoniemi, N. Scherbaum, M, Torrens, M. Farre, I. Flores, M. Rossi, D. Eastwood, C. Guionnet, S. Rawaf, L. Agosti, L. Di Furia, R. Brigada, A. Majava, H. Siemann, M. Leoni, A. Tomasin, F. Rovetto, F. & A.H. Ghodse. 2006. ‘Drugs on the web; the Psychonaut 2002 EU project.’ Progress in Neuro-Psychopharmacology & Biological Psychiatry 30: 640- 646. doi:10.1016/j.pnpbp.2005.11.035. As of 12 June 2016: http://public- files.prbb.org/publicacions/3553b32f-e0c5-4b8a-bc18-4c8e634263b9.pdf
Schmidt, M.M., A. Sharma, F. Schifano, & C. Feinmann. 2011. ‘“Legal highs” on the net – Evaluation of UK-based websites, products and product information.’ Forensic Science International 206 (1-3): 92-97. doi:10.1016/j.forsciint.2010.06.030
Security.nl. 2014. Politie onderzoekt illegale marktplaatsen op Tor-netwerk. As of 12 June 2016: https://www.security.nl/posting/378232/Politie+onderzoekt+illegale+marktplaatsen+op+Tor-netwerk
Shy, Oz. 2001. The Economics of Network Industries. Cambridge: Cambridge University Press.
Soska, K. and Christin, N. (2015). ‘Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem.’ In Proceedings of the 24th USENIX Security Symposium (USENIX Security'15), 33-48. As of 12 June 2016: https://www.andrew.cmu.edu/user/nicolasc/publications/SC-USENIXSec15.pdf
Soska, K., A. Kwon, N. Christin, & S. Devadas. 2016. ‘Beaver: A Decentralized Anonymous Marketplace with Secure Reputation.’ [Eprint ahead of publication]. As of 12 June 2016: https://eprint.iacr.org/2016/464.pdf
Spapens, T., T. Müller, & H. Bunt. 2014. ‘The Dutch Drug Policy from a Regulatory Perspective.’ European Journal on Criminal Policy and Research 21 (1): 191-205.
Stephenson, G. & A. Richardson. 2014. New Psychoactive Substances in England. A review of the evidence. London: Home Office.
Steward, K. 2013. ‘The 21st century’s Silk Road.’ As of 12 June 2016: http://traccc.gmu.edu/wp- content/uploads/2013/06/2013.05.11-Karen-Bentley-Steward-The-21st-Centurys-Silk-Road.pdf
118 Internet-facilitated drugs trade RAND Europe
The Gallup Organization. 2011. Flash Eurobarometer 330: Youth attitudes on drugs. Analytical report. Brussels: European Commission.
The New Psychoactive Substances Review Expert Panel. 2014. New Psychoactive Substances Review. Report of the Expert Panel. London: Home Office.
TNS Political and Social. 2014. Flash Eurobarometer 401: Young people and drugs. Brussels: European Commission.
Trautmann, F. 2016. Expert Meeting on Internet and Drugs. Background Paper. [Background paper as prepared at the request of the European Commission, DG Migration and Home Affairs, Anti-drug policy unit.]
Tzanetakis, M., G. Kamphausen, B. Werse, & R. von Laufenberg. 2015. ‘The transparency paradox. Building trust, resolving disputes and optimising logistics on conventional and online drugs markets.’ The International Journal of Drug Policy. doi:10.1016/j.drugpo.2015.12.010.
UNODC. 2014. World Drug Report 2014. Vienna: United Nations Office on Drugs and Crime. As of 21 June 2016: http://www.unodc.org/wdr2014/ UNODC. 2015. World Drug Report 2015. Vienna: United Nations Office on Drugs and Crime. As of 21 June 2016: http://www.unodc.org/wdr2015/
UNSTATS. 2013. ‘Composition of macro geographical (continental) regions, geographical sub-regons, and selected economic and other groupings. ’ As of 11 June 2016 http://unstats.un.org/unsd/methods/m49/m49regin.htm
Van Amsterdam, J.G., T. Nabben, D. Keiman, G. Haanschoten, & D. Korf. 2015. ‘Exploring the Attractiveness of New Psychoactive Substances (NPS) among Experienced Drug Users.’ Journal of Psychoactive Drugs 47 (3): 177-181. doi:10.1080/02791072.2015.1048840
Van Buskirk J., A. Roxburgh, R. Bruno, & L. Burns. 2013. Drugs and the Internet, Issue 1. Sydney: National Drug and Alcohol Research Centre.
Van Buskirk J., A. Roxburgh, R. Bruno, & L. Burns. 2014. Drugs and the Internet, Issue 4. Sydney: National Drug and Alcohol Research Centre.
Van Buskirk, J., A. Roxburgh, S. Naicker, & L. Burns. 2015. ‘A response to Dolliver's “Evaluating drug trafficking on the Tor network”.’ International Journal of Drug Policy 26 (11): 1126–1127. doi:10.1016/j.drugpo.2015.07.001
Van Buskirk, J., A. Roxburgh, R. Bruno, , S. Lenton, R. Sutherland, E. Whittaker, N. Sindicich, A. Matthews, K. Butler, K. & L. Burns. 2016. ‘Characterising dark net marketplace purchasers in a sample of regular psychostimulant users.’ The International Journal of Drug Policy. doi:10.1016/j.drugpo.2016.01.010
Van Buskirk, J., Roxburgh, A., Farrell, M. & L. Burns. 2014. ‘The closure of the Silk Road: what has this meant for online drug trading?’ Addiction 109: 517–518. doi:10.1111/add.12422
119 RAND Europe Internet-facilitated drugs trade
Van Hout, M. C. & T. Bingham. 2013b. ‘Surfing the Silk Road’: a study of users' experiences.’ International Journal of Drug Policy 24 (6): 524–529. doi:10.1016/j.drugpo.2013.08.011
Van Hout, M.C. & T. Bingham. 2013a. ‘Silk Road', the virtual drug marketplace: A single case study of user experiences.’ International Journal of Drug Policy 24 (5): 385–391. doi:10.1016/j.drugpo.2013.01.005
Van Hout, M.C. & T. Bingham. 2014. ‘Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading.’ International Journal of Drug Policy 25 (2): 183-189. doi:10.1016/j.drugpo.2013.10.009
Van Slobbe, J. 2016. ‘The drugs trade on the deep web: a law enforcement perspective.’ In The Internet and drug markets, edited by EMCDDA, 77–84. Lisbon: EMCDDA.
Vardakou, I., C. Pistos, & Ch. Spiliopoulou. 2011. ‘Drugs for youth via Internet and the example of mephedrone.’ Toxicology Letters 201 (3): 191–195. doi:10.1016/j.toxlet.2010.12.014
Villasenor, J., C. Monk, & C. Bronk. 2011. ‘Shadowy figures: tracking illicit financial transactions in the murky world of digital currencies, peer-to-peer networks, and mobile device payments.’ Brookings Institution.
Volery, R. 2015. Vente de drogues sur les cryptomarchés: techniques d’envoi et transmission des connaissances. [Master’s thesis] Lausanne: School of Criminal Sciences, Univesité de Lausanne
Woolf, Nicky. 2015. ‘Bitcoin 'exit scam': deep-web market operators disappear with $12m’. The Guardian, 18 March. As of 12 June 2016: http://www.theguardian.com/technology/2015/mar/18/bitcoin-deep-web-evolution-exit-scam-12- million-dollars
Xfinity. 2016. ‘What are Internet Service Providers?’ As of 12 June 2016: http://www.xfinity.com/resources/Internet-service-providers.html
120
Appendix A: Drug categories
Table A.1. Drug categories
Drug category Drug types included in the category
Cannabis edibles extracts hash herbal synthetics other Ecstasy-type MDMA: pills, crystal, powder euphoric stimulants cathinones combinations of above Prescription benzodiazepines, sedatives, hypnotics, opioids steroids, androgens, anabolic agents, stimulants anti-cancer anti-depressants sexual dysfunction infertility, contraception, abortion other prescription drugs Psychedelics NBOMes 2-cs other phenethylamines tryptamines lysergides dissociatives other Stimulants amphetamines cocaine methamphetamine other synthetics piperazines (table continues on next page)
121 RAND Europe Internet-facilitated drugs trade
Table A.1. Drug categories (continued)
Drug category Drug types included in the category
Opioids heroin NPS opioids other Alcohol Tobacco + nicotine Other drugs
122
Appendix B: Search protocol
123 RAND Europe Internet-facilitated drugs trade
Table B.1. Search strategy6465
Search queries
"online drug "online drug ("online drug market*" drug* AND ("drug* ("illict drug*" OR "cybercrime" (“legal high” OR "law "law market*" OR "online market*" OR "online OR "online bazaar" OR ("dark net" sale*") AND “legal high” OR AND ("illicit* “new psychoactive enforcement” enforcement” bazaar" OR "dark bazaar" OR "dark "dark net" OR darknet OR darknet ("clear net" “new psychoactive drug*" OR substance*” OR AND "illicit AND NPS net" OR darknet OR net" OR darknet OR OR "dark web" OR OR "dark OR internet substance*” OR “legal high” OR "NPS” OR drugs" AND AND ("clear "dark web" OR "dark web" OR cryptomarket* OR web" OR OR "open "NPS” OR “new "research ("dark web" net" OR cryptomarket* OR crypto market* OR "crypto market" OR "cryptomark web") "research psychoactive chemical*") AND OR "dark net" internet OR "crypto market" OR "crypto market" OR "Tor Network", "drug* et*" OR chemical*") AND substance*” OR (online OR “online OR darknet) "open web") "Tor Network" OR "Tor Network" OR traffic*" OR "drug "crypto ("clear net" OR "NPS” OR sale” OR “social "online drug* "online drug* trade") AND ("Silk market*" internet OR "open "research media” OR traffic*" OR "online traffic*" OR "online Road" OR “Pandora” OR "deep web") chemical*") advertis* OR Databases ↓ drug trade" drug trade" OR “Agora”) web") headshop*)
Google Scholar Total number of hits: Total number of hits: Total number of hits: 44 Total Total number Total number of Total number of Total number of Total number Total number 5,370 24,300 Total relevant hits: 11 number of of hits: 239 hits: 79,800 hits: 281 hits: 255,000 of hits: 88 of hits: Total relevant hits: 0 Total relevant hits: 2 hits: 1,380 Total relevant Total relevant hits: Total relevant Total relevant hits: Total relevant 4,530 Total hits: 0 3 hits: 0 0 hits: 4 Total relevant hits: relevant hits: 4 2
Googlea Total number of hits: Total number of hits: Total number of hits: Total Total number Total number of Total number of Total number of Total number Total number 2,560,000 4,120,000 63,400 number of of hits: hits: 2,370,000 hits: 79,400 hits: 17,600,000 of hits: 8,010 of hits: Total relevant hits: 1 Total relevant hits: 0 Total relevant hits: 0 hits: 68,200,000 Total relevant hits: Total relevant Total relevant hits: Total relevant 310,000 338,000 Total relevant 0 hits: 1 3 hits: 1 Total Total hits: 0 relevant hits: relevant hits: 0 0
64 The searches where conducted on 3 and 4 January 2016. 65 For Google and Google Scholar, only the first two results’ pages were scanned for relevant literature. For the other databases, the first 100 results were scanned.
124 Internet-facilitated drugs trade RAND Europe
Search queries (continued from previous page – similar search queries)
"online drug "online drug ("online drug market*" drug* AND ("drug* ("illict drug*" OR "cybercrime" (“legal high” OR "law "law market*" OR "online market*" OR "online OR "online bazaar" OR ("dark net" sale*") AND “legal high” OR AND ("illicit* “new psychoactive enforcement” enforcement” bazaar" OR "dark bazaar" OR "dark "dark net" OR darknet OR darknet ("clear net" “new psychoactive drug*" OR substance*” OR AND "illicit AND NPS net" OR darknet OR net" OR darknet OR OR "dark web" OR OR "dark OR internet substance*” OR “legal high” OR "NPS” OR drugs" AND AND ("clear "dark web" OR "dark web" OR cryptomarket* OR web" OR OR "open "NPS” OR “new "research ("dark web" net" OR cryptomarket* OR crypto market* OR "crypto market" OR "cryptomark web") "research psychoactive chemical*") AND OR "dark net" internet OR "crypto market" OR "crypto market" OR "Tor Network", "drug* et*" OR chemical*") AND substance*” OR (online OR “online OR darknet) "open web") "Tor Network" OR "Tor Network" OR traffic*" OR "drug "crypto ("clear net" OR "NPS” OR sale” OR “social "online drug* "online drug* trade") AND ("Silk market*" internet OR "open "research media” OR traffic*" OR "online traffic*" OR "online Road" OR “Pandora” OR "deep web") chemical*") advertis* OR Databases ↓ drug trade" drug trade" OR “Agora”) web") headshop*)
EBSCO (Criminal Total number of hits: Total number of hits: Total number of hits: Total Total number Total number of Total number of Total number of Total number Total number Justice Abstracts; 79 79 (AND Silk Road:5,762); number of of hits: hits: (AND "clear hits: 15,535 hits: (AND of hits: 0 of hits: 4 Social Sciences Total relevant hits: 2 Total relevant hits: 0 (AND Pandora: 6,015); hits: 28 152,092 net": 16,019); Total relevant "online": 15,532); Total relevant Total Abstracts; (AND Agora: 5,845) Total Total relevant (AND internet: hits: 0 (AND "online hits: 0 relevant hits: Academic Search Total relevant hits: 0 relevant hits: hits: 0 16,031); (AND sale": 15,524); 1 Complete; EconLit; 0 "open web": (AND "social and National 16,019) media": 15,524); Criminal Justice Total relevant hits: (AND adverstis*: Reference Service 0 15,524 ); (AND Abstracts)b headshop: 15,525) Total relevant hits: 0
The Campbell Total number of hits: Total number of hits: Total number of hits: 0 Total Total number Total number of Total number of Total number of Total number Total number Collaboration 0 92 Total relevant hits: 0 number of of hits: 0 hits: 98 hits: 0 hits: 257 of hits: 0 of hits: 0 Library of Total relevant hits: 0 Total relevant hits: 0 hits: 0 Total relevant Total relevant hits: Total relevant Total relevant hits: Total relevant Total Systematic Total hits: 0 0 hits: 0 0 hits: 0 relevant hits: Reviewsc relevant hits: 0 0
Taylor and Francis Total number of hits: Total number of hits: Total number of hits: 0 Total Total number Total number of Total number of Total number of Total number Total number Onlined 90 913 Total relevant hits: 0 number of of hits: 11 hits: 0 hits: 0 hits: 0 of hits: 0 of hits: 0 Total relevant hits: 3 Total relevant hits: 0 hits: 65 Total relevant Total relevant hits: Total relevant Total relevant hits: Total relevant Total Total hits: 0 0 hits: 0 0 hits: 0 relevant hits: relevant hits: 0 0
PubMede Total number of hits: Total number of hits: Total number of hits: 0 Total Total number Total number of Total number of Total number of Total number Total number 1285 125 Total relevant hits: 0 number of of hits: 0 hits: 132 hits: 0 hits: 167 of hits: 0 of hits: 2 Total relevant hits: 0 Total relevant hits: 0 hits: 185 Total relevant Total relevant hits: Total relevant Total relevant hits: Total relevant Total
125 RAND Europe Internet-facilitated drugs trade
Total hits: 0 0 hits: 0 1 hits: 0 relevant hits: relevant hits: 0 0
International Dark net: 29 (1 Society for the relevant) Study of Drug Drugs internet: 138 Policy Grey (0 relevant) Literature Silk Road: 18 hits (0 Bibliographyf relevant) New Psychoactive Substances: 110 hits (1 relevant) NOTES: a Excluding news articles and specific websites about the dark net. b Searched for all except 'news', 'magazines', 'reviews' c Searched in ‘all text’ d Used advanced search: 'search everything', journal, 'all content’. e Use of general 'search' box. f Current search strings did not lead to any results, so used different, shorter search terms instead.
126 Internet-facilitated drugs trade RAND Europe
Table B.2. Additional websites searched
Additional websites searched: Comments
Enisa country reports and national security strategies No publications
Publications on www.ncsc.nl No publications
EMCDDA's annual European Drug Reports Publications found
Reports INCB Publications found
Reports UNODC Publications found
Kamerstukken: https://zoek.officielebekendmakingen.nl/zoeken/parlementaire_documenten Publications found
Websites of law enforcement agencies (e.g. Europol, Interpol, Eurojust, FBI, US Immigration and Customs Publications found Enforcement, National Crime Agency (UK), etc.)
127
Appendix C: Overview of studies that collected quantitative information on online drug markets
Table C.1. Overview of studies that collected quantitative information on drug markets on the dark net
Study details Data collection method(s) Number of Listings Number of Country of origin of Size markets vendors vendors
1. Aldridge and Primary research (crawling Silk One market 10,927 active drug listings 1,031 vendors 41 countries. For 11 Estimated monthly Décary-Hétu Road 1.0 between 13-15 analysed countries vendors were revenue for selected (2016a). September) Revised approach on involved in wholesale drug categories: Academic Aldridge and Décary-Hétu 2014 level transactions cannabis ($2,038,213); paper data, as included below (countries with the ecstasy $1,613,840); highest share of listings opioids ($284,972); >$1,000 were: China prescription ($999,872); (46%), Belgium (20%), psychedelics Canada (15%) and the ($712,574); stimulants Netherlands (12%)) ($1,330,989)
2. Soska and Primary research (long-term Initial scraping A total of 78,509 items that 9,386 vendors Not examined/ not Seven markets were Christin measurement analysis through of 35 markets, “returned at least one across the mentioned in study used to measure the (2015). crawling and parsinga 16 market of which 16 acceptable observation” were measurement revenues yet not all were Academic places between 2013-2015), were then identified (p. 8)c interval (29,258 active at the same time. paper combined with secondary data parsed and unique aliases) Revenues appear to be further in the $550,000/day to analysedb $650,000/day range (Silk Road in summer of 2013: ~300,000/day,
129 RAND Europe Internet-facilitated drugs trade
Study details Data collection method(s) Number of Listings Number of Country of origin of Size markets vendors vendors
which would be about $100m annually)
3. Dolliver Primary research (crawling Silk One market 1,834 unique items, 348 145 vendors Vendors shipped from Not examined. (2015)d. Road 2.0 in August and analysed drug items (mostly stimulants 19 countries. For drug Academic September 2014) and hallucinogens) items, this mainly paper involved: US (26%), Germany (14%), UK (13.8%) and Australia (13%). The Netherlands represented 6%.
4. Buxton and Not reported for these data (May- Three markets Evolution: 17,512 listings; Not examined/ Not examined/ not Market share of total Bingham October 2014) included Agora: 17,200 listings; and not mentioned in mentioned in study listings: Evolution: 28%; (2015) (Evolution, Silk Road 2.0: 15,837 study Agora: 27.5%; Silk Agora and Silk listings (listings not further Road 2.0: 25.3%. This Road 2.0) specified). Listings of these reflected a 41% market markets reflected 81% of total contribution to listings on cryptomarkets cryptomarkets between between May-October 2014 May-October 2014
5. Bartlett (2015). Secondary research (analysis of One market Not examined/ not Study looked at United States (33%), Annual income between Journalism sales data of top vendors on Silk analysed mentioned in this study a sample of 867 United Kingdom (10%) $60,000-$120,000 per Road 2 between January and April vendors and Australia (10%). vendor (rough estimate 2014. Data used for this analysis Remaining percentages based on a selection of were collected by an anonymous not reported in this study nine medium-size SR user who posted the data files vendors) on a forum)
6. Ciancaglini et Secondary research, but lacks All dark net Cannabis (31.60%); Not examined/ Not examined/ not Not examined/ not al. (2015). transparency and clarity about markets (not pharmaceuticals (21.05%); not mentioned in mentioned in study mentioned in study Report methodology (made use of further MDMA (10.53%); LSD, meth, study https://dnstats.net/ that collects specified) mushrooms, heroin, seeds, dark net markets’ data. Data video games, online accounts retrieved 3 June 2015) (all 5.26% each)e
130 Internet-facilitated drugs trade RAND Europe
Study details Data collection method(s) Number of Listings Number of Country of origin of Size markets vendors vendors
7. Aldridge and Primary research (crawling Silk One market 11,904 active listings in Silk 1,084 Not examined/ not Annual revenue for 90% Décary-Hétu Road 1.0 in September 2013) analysed Road’s ‘drugs’ section vendors in Silk mentioned in study of ‘drug’ listings (2014). (11,853 relevant listings were Road’s ‘drugs’ estimated at $89.7m Academic included for analysis), with six section paper categories capturing 90% of all drug listings (cannabis, ecstasy, opioids, prescriptions, psychedelics and stimulants)
8. Kooistra and Primary research (crawling 4 4 markets Not examined/not mentioned Study only NA (only looked at The Dutch share was Trommelen market places for 1.5 months in analysed in study (study refers to type looked at the share of Dutch vendors) estimated to be 12% (of (2014). 2014, only looking for Dutch (Agora, of drugs that was sold online, share of Dutch €81m total revenue) on Journalism share on these sites) Pandora, Silk see ‘Size’) vendors (or Agora and 7% (of €64m Road 2, Dutch web total revenue) on Silk Evolution) shops/dealers as Road 2 annually.f The they call it) and share is unknown for found 26 Dutch Pandora and Evolution. web shops on Type of drugs sold these market online by Dutch vendors: places ecstasy (29%), herbal cannabis (27.5%), cannabis resin (16.4%), cocaine and speed (15.6%), heroin and opiates (5.7%), psychedelics (LSD) (3.8%), other (2.0%)
9. Digital Citizens Primary research (monitoring the 12 markets As of 29 January 2014: a Not Not examined/not Not examined/not Alliance listings on 12 market places, analysed total of 32,029 drug listings examined/not mentioned in study mentioned in study (2014a). method not further specified. across 12 market places (out mentioned in Report Conducted one day in January of a total of 41,207 listings). study 2014) Type of drugs not further specified.
131 RAND Europe Internet-facilitated drugs trade
Study details Data collection method(s) Number of Listings Number of Country of origin of Size markets vendors vendors
10. Digital Citizens Primary research (monitoring the 12 markets As of 17 December 2014: a Not Not examined/not Not examined/not Alliance listings on 12 market places, analysed total of 32,362 drug listings examined/not mentioned in study mentioned in study (2014b). method not further specified. across 12 market places (out mentioned in Report Conducted one day in December of a total of 51,755 listings). study 2014) Type of drugs not further specifiedg
11. Phelps and Primary research (lack of clarity on One market Listings from vendors based in 27 vendors who 27 vendors who Not possible to provide Watt (2014). methodology used for quantitative analysed Australia: 191 listings, which indicated to be indicated to be based in accurate calculation Academic data, which involved monitoring were all listed in the based in Australia paper Silk Road through using a user Australian Drug Misuse and Australia account. Conducted in July 2012) Trafficking Act (not further specified)
12. Van Buskirk et Primary research (monitoring 23 markets Study looked at the number of International and Not examined/not Not examined al. (2014). markets through using a domestic analysed of retailers selling substances to domestic mentioned in study (only Report user account. Conducted between which 11 Australia (only for five vendors selling looked at ‘international’ July 2014 and December 2014). remained active markets: Agora, Evolution, to Australia versus ‘domestic’) Only focused on international during the Silk Road 2.0, Pandora and varied per retailers selling to Australia and monitored Cloud Nine): cannabis, market. Retailers Australian retailers. periodhi pharmaceuticals and MDMA on markets still were most commonly active in available December 2014: Evolution (1154); Agora (836) and Nucleus (almost 200)
13. Christin Primary research (crawling Silk One market In total, over 24,400 unique 220 in Top 5 “most frequent Total revenue slightly (2013). Road 1.0 for 8 months between analysed items were identified (not just November shipping origins” (p. 5, over $1.2m per month Academic 2011-2012) drugs), with main categories 2011; 564 in more details included in (annual revenue of paper relating to narcotics or July 2012 (a Table 2 of the study): ~$15m) controlled substances, with core of 112 USA (43.83%); marijuana accounting for the vendors undeclared (16.29%);
132 Internet-facilitated drugs trade RAND Europe
Study details Data collection method(s) Number of Listings Number of Country of origin of Size markets vendors vendors
top category throughout UK (10.15%), the studied period) Netherlands (6.52%) and Canada (5.89%)
14. Van Buskirk et Primary research (monitoring Silk One Study looked at the number of International and Not examined/not Not examined al. (2013). Road every fortnight between cryptomarket retailers selling substances to domestic mentioned in study (only Report August 2012 and February 2013, analysedh Australia: cannabis, NPS vendors selling looked at ‘international’ with one search in December (study speaks of ‘Emerging to Australia rose versus ‘domestic’) 2012. Only focused on Psychoactive Substances’) from 282 mid- international retailers selling to and MDMA were most September 2012 Australia and Australian retailers) commonly available to 374 in early February 2013. Domestic vendors specifically increased from 36 mid- September to 44 in February 2013
133 RAND Europe Internet-facilitated drugs trade
66 Table C.2. Overview of studies that collected information on clear net markets
Study details Data collection Number of markets Listings Other information method(s)
1. Martinez et al. (2016). Primary research (use of As of May 2014, 584 Listings for each shop not Majority of shops were classified as shops selling research Report own software called shops were identified. provided, but study looked at chemicals. Classifications are: “research chemical shops’ if ‘Shop Finder’ and The following number of NPS the substances are displayed mostly with their chemical ‘Product Scraper’ tailored shops active as of May names, often with an image of their chemical structure; for “country-specific 2014 were(duplicates ‘commercial/branded shops’ if the substances are mainly search phrases and removed): Czech displayed with their trade names; ‘herbal shops’ if the site search engines” (p. 98). Republic (30), France offers primarily plant-related substances as well as Monitoring of online (64), the Netherlands commercial products; ‘other’ if the sites offer products shops was conducted (19), Poland (72) and the relating to sexual performance, health or general wellness” between November United Kingdom (207) (p. 100). 2013 and May 2014)
2. EMCDDA (2009). Primary research 115 shops were Listings not provided in detail, “The majority of online retailers identified were based in Report (EMCDDA snapshot identified, located in 17 but report does specify for the United Kingdom (37 %), Germany (15 %), methodology, see countries particular psychoactive Netherlands (14 %) and Romania (7 %)” (p. 93). EMCDDA 2011b. substances where they were Conducted in 2009) found
3. EMCDDA (2011a). Primary research 314 online shops Listings not provided in detail, There is a detailed overview of “apparent country of origin Report (EMCDDA snapshot identified that sold ‘legal but report does specify for of online shops offering ‘legal highs’” (p. 96) and an methodology, see highs’ in 2011; 23 shops particular psychoactive overview of where online shops selling mephedrone are EMCDDA 2011b. selling mephedrone early substances where they were based. Conducted between 011) found December 2009 and
66 The included articles did not use the term ‘clear net’, yet talk about ‘Internet’ more generally. However, given their methods used, the research team assumed this was clear net. Where studies only briefly referenced to, for example, a number of online shops and sometimes without indicating through which methods this number was obtained, this was not included in this table. An example is a report by DrugScope (2014), which mentioned that there are around 250 online and offline shops in total in the UK that sell NPS. Another example includes work by Schifano et al. (2005), in which it was only briefly mentioned that of the websites identified, 5 websites offered the option to buy a particular NPS (2C- T-7).
134 Internet-facilitated drugs trade RAND Europe
Study details Data collection Number of markets Listings Other information method(s)
February 2011)a
4. EMCDDA (2011b). Primary research (annual 631 online shops Table 2on p.6 of the report The “likely” countries of origin of the shops were listed (p. Report EMCDDA snapshot study identified that sold NPS provides an overview of the 4). Prices for most frequently identified NPS were through crawling “online in July 2011b “most frequently identified” provided. websites (retailers and NPS (p. 6). wholesale) easily accessible to a random Internet user interested in buying psychoactive substances” (p. 3). Conducted in July 2011)
5. Hillebrand, J., Olszewski, D. Primary research 69 online shops in the EU Report focused on ‘legal Country of origin of shops was reported (n = 69): Austria and Sedefov, R. (2010). (EMCDDA snapshot were identified highs’ and ‘herbal highs’. For (4.4%); Ireland (1.5%); Germany (5.8%); the Netherlands Academic paper methodology, see a selection of 27 shops, more (36.2%) and the United Kingdom (52.2%). Prices for EMCDDA 2011b. than 500 unique products selected NPS were provided. Conducted between were advertised February 2008 and June 2008)
6. Nizar, H., Dargan, P.I. and Primary research 20 websites selling 4- This study specifically looked Prices were provided. Wood, D.M. (2015). (EMCDDA snapshot methylaminorex and 1 at two NPS: 4- Academic paper methodology, single-time selling 4,4′- Methylaminorex and 4,4′- point English only through dimethylaminorex Dimethylaminorex using google.co.uk. identified Conducted in April 2014)
7. Van Buskirk et al. (2014). Primary research Study speaks of “number This study focused on NPS by The increase in number of retailers might be explained by Report (EMCDDA snapshot of unique retailers” (p. 3): searching for ‘legal highs’, expanded methodology instead of an actual rise. methodology by using 67 in July 2014; 78 in ‘research chemicals’ and Zoo search engine. December 2014 other equivalents, but listings Online forums were identified on these web shops searched references to were not provided
135 RAND Europe Internet-facilitated drugs trade
Study details Data collection Number of markets Listings Other information method(s)
NPS web shops on the clear net. Conducted between July 2014- December 2014). Only focused on those websites selling and shipping to Australia.d
8. Van Buskirk et al. (2013). Primary research Study speaks of 'number “Number of retailers selling Report (EMCDDA snapshot of unique retailers” (p. 3): the ten most common EPS” methodology using a 92 in September 2012; (i.e. NPS, study speaks of Metacrawler search 101 in February 2013 ‘Emerging Psychoactive engine. Conducted Substances’) in September monthly between August 2012-February 2013 (p. 5): 2012-February 2013, 6-APB (149), Ethylphenidate except December 2012). (126); aMT (123); Only focused on websites Methiopropamine (115); shipping to Australia.d MDAI (104); 5-MeO-DALT (101); Etizolam (99); AM2201 (96); UR-144 (85); 5-APB (82).e
9. Schifano, et al. (2006). Primary research N/Af Examples included, but not A total of 165 websites (10.1%) offered “the possibility to Academic paper (snapshot study of a limited to, opioid analgesics purchase drug-related items (including paraphernalia “purposeful sample of and Plants, herbs, mixtures and/or psychoactive drugs)” (p. 643). 1633 unique websites”(p. 640).c Conducted during one week in June 2003)
10. Schmidt, M.M., Sharma, A., Primary research 39 online shops in the UK 346 unique products were Average price of per product was £9.69. Schifano, F. and Feinmann, (snapshot study of a were identified identified across all shops C. (2011). “purposeful sample of (see table 1 on p. 95 for the Academic paper 264 results” (p. 93) as top 25 products) found through using two
136 Internet-facilitated drugs trade RAND Europe
Study details Data collection Number of markets Listings Other information method(s)
search engines to search for UK-based online shops selling legal highs. Search conducted on 7 April 2009 and selected websites analysed between April-June 2009)
11. Bigdeli, I., Corazza, O., Primary research 51 websites aimed at Herbal, chemical-synthetic This study was more focused on the type of NPS sold Aslanpour, Z., Schifano, F. (“qualitative exploratory “NPS purchase” (p. 512) and semi-synthetic drugs, online instead of estimating the size. (2013). online search and pharmaceuticals, Academic paper monitoring” of Persian others/combinations language websites (p. (categories further specified 512). Conducted in report) October 2011-February 2012)
12. Corazza, O., Sulaf, A., Primary research 65 websites identified 45 NPS identified (typically Prices varied between $8 and $230). This study was more Malekianragheb, S., Mitra (monitoring websites in “were deemed to be pro included: cathinone focused on the type of NPS sold online instead of Naderi, B., Bigdeli, I., Farsi and Arabic through drug websites and derivatives, classical/latest estimating the size. Aslanpour, Z., Schifano, F. different search engines. appeared to be offering generation (2014). Conducted between NPS for purchase” (p. psychedelicphenethylamines, Academic paper October 2011 and 725) ketamine derivatives, September 2013) tryptamines and ‘Spice’ derivatives)
13. Deluca, P., Davey, Z., Primary research 203 websites were 414 substances and products This study does not distinguish between website or forum, Corazza, O., Di Furia, L., (“qualitative exploratory identified, which were found on these websites so it is unclear how many of them were online shops. Farre, M., Flesland, L., online searches” by using consisted of a mix of (not specified which ones Mannonen, M., Majava, A., several resources in 8 forums, shops, social were found on online shops) Peltoniemi, T., & Pasinetti, languages (p. 222). media, etc. M. (2012). Conducted between Academic paper 2008 and 2010)
14. Lahaie, E., Martinez, M. and Primary research 30 online shops in French NPS (no further details
137 RAND Europe Internet-facilitated drugs trade
Study details Data collection Number of markets Listings Other information method(s)
Cadet-Taïrou, A. (2013). (snapshot, methodology language provided) Report not further specified. Conducted at the end of 2011)
NOTE: a Note that several snapshots were conducted in this period. The study separately reports on searches conducted for ‘legal highs’ in 2010 and 2011and searches conducted for mephedrone between December 2009 and February 2011. b In January 2012, this number was 693 in January 2012 (EMCDDA and Europol, 2013) and 651 in 2013 (EMCDDA 2015a) c “An 8-language, two-engine, assessment of the information available in a purposeful sample of 1633 unique websites was carried out” (Schifano et al. 2006, 640). Search engines included Google and AltaVista. Languages covered: English, French, Italian, Finnish, Danish, German, Spanish and Portuguese. d This study also looked at the dark web, as discussed in Table C.1. e According to the authors, these numbers do not reflect unique retailers. f The study aimed to collect data on drug-related content on websites, including information on consumption and production, not just sales.
138
Appendix D: Bibliography of identified literature
Included for detailed analysis67 Advisory Council on the Misuse of Drugs. 2011. ‘Consideration of the Novel Psychoactive Substances (‘Legal Highs’).’ As of 23 June 2016: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/119139/acmdnps201 1.pdf
Aldridge, J. & D. Décary-Hétu. 2014. ‘Not an ‘Ebay for Drugs’: The cryptomarket “Silk Road” as a paradigm shifting criminal innovation.’ As of 23 June 2016: http://ssrn.com/abstract=2436643
Aldridge, J. & D. Décary-Hétu, 2015. ‘Sifting through the Net: Monitoring of online offenders by researchers.’ The European Review of Organised Crime 2: 122-141.
Aldridge, J. & D. Décary-Hétu, 2016. Cryptomarkets and the future of illicit drug markets. In The Internet and drug markets, edited by EMCDDA, pp. 23-32, Lisbon: EMCDDA.
Barratt, M.J. 2012. ‘Silk Road: eBay for drugs.’ Addiction 107: 683-683. doi:10.1111/j.1360- 0443.2011.03709.x
Barratt, M.J., J. Ferris, & A. Winstock. 2014. ‘Use of Silk Road, the online drug marketplace, in the United Kingdom, Australia and the United States.’ Addiction 109 (5): 774–783. doi:10.1111/add.12470
Bartlett, J. 2015. The Dark Net: Inside the Digital Underworld. Brooklyn: Melville House.
Basu, G. 2014. ‘The strategic attributes of transnational smuggling: Logistics flexibility and operational stealth in the facilitation of illicit trade.’ Journal of Transportation Security 7(2): 99–113.
Benschop, A., T. Nabben, & D.J. Korf.2015. Antenne 2014: trends in alcohol, tabak en drugs bij jonge Amsterdammers. Amsterdam: Rozenberg Publishers..
Bigdeli, I., O. Corazza, Z. Aslanpour, & F. Schifano. 2013. ‘Novel Psychoactive Substances (NPS): a Study on Persian Language Websites.’ Iranian Journal of Public Health 42 (5): 511–515.
Buxton, J. & T. Bingham. 2015. ‘The Rise and Challenge of Dark Net Drug Markets.’ Global Drug Policy Observatory, Swansea University, Policy brief 7. As of 23 June 2016: http://www.drugsandalcohol.ie/23274/1/Darknet%20Markets.pdf
67 The articles listed here were included for detailed analysis in qualitative data analysis computer software NVivo.
139 RAND Europe Internet-facilitated drugs trade
Cadet-Taïrou, A., M. Gandilhon, E. Lahaie, M. Martinez, S. Dambélé, & S. Saïd. 2013. Markets, products, users: recent trends (2011-2012). Saint-Denis: Observatoire Français des Drogues et des toxicomanies.
Christin, N. 2013. ‘Traveling the Silk Road: a measurement analysis of a large anonymous online marketplace.’ Paper presented at the International World Wide Web Conference (IW3C2), 13– 17 May 2013, Rio de Janeiro, Brazil. As of 23 June 2016: http://www.andrew.cmu.edu/user/nicolasc/publications/Christin-WWW13.pdf
Ciancaglini, V., M. Balduzzi, R. McArdle, & M. Rösler. 2015. ‘Below the Surface: Exploring the Deep Web.’ Trend Micro Incorporated. As of 23 June 2016: https://www.trendmicro.com/cloud- content/us/pdfs/security-intelligence/white-papers/wp_below_the_surface.pdf
Corazza, O., F.S. Bersani, G. Valeriani , F. Shifano, 2016. ‘Technologies and Lifestyles: how the Internet has revolutionized the drug market and people’s lives.’ In Synthetic and Novel Drugs : Emerging Issues, Legal Policy and Public Health, edited by J.M. Stogner, B.L. Miller & D.N. Khey. CRC Press.
Corazza, O., A. Sulaf, S. Malekianragheb, B. Mitra Naderi, I. Bigdeli, Z. Aslanpour, & F. Schifano. 2014. ‘Monitoring novel psychoactive substances allegedly offered online for sale in Persian and Arabic languages.’ International Journal of Drug Policy 25 (4):724-726. doi:10.1016/j.drugpo.2014.05.005
Cox, J. 2016. ‘Reputation is everything: the role of ratings, feedback and reviews in cryptomarkets.’ In The Internet and drug markets, edited by EMCDDA, 49-54. Lisbon: EMCDDA.
Cox, J. 2016. ‘Staying in the shadows: the use of bitcoin and encryption in cryptomarkets.’ In The Internet and drug markets, edited by EMCDDA, 41-47. Lisbon: EMCDDA.
Davies, S., D.M. Wood, G. Smith, J. Button, J. Ramsey, R. Archer, D.W. Holt, P.I. Dargan, 2010. Purchasing ‘legal highs’ on the Internet – is there consistency in what you get? The Quarterly journal of medicine Association of Physicians of Great Britain and Ireland 103: 489-493.
Deluca, P., Z. Davey, O. Corazza, L. Di Furia, M. Farre, L. Flesland, M. Mannonen, A. Majava, T. Peltoniemi, & M. Pasinetti. 2012. ‘Identifying emerging trends in recreational drug use; outcomes from the Psychonaut Web Mapping Project.’ Progress in Neuro-Psychopharmacology and Biological Psychiatry 39 (2): 221-226. doi:10.1016/j.pnpbp.2012.07.011
Digital Citizens Alliance. 2014a. ‘Busted, but not broken. The state of Silk Road and the Darknet Marketplaces. A Digital Citizens Alliance Investigative Report (April 2014).’ As of 23 June 2016: https://media.gractions.com/314A5A5A9ABBBBC5E3BD824CF47C46EF4B9D3A76/5f8d4168- c36a-4f78-b048-f5d48b18dc0a.pdf
Digital Citizens Alliance. 2014b. ‘Darknet Marketplace Watch - Monitoring Sales of Illegal Drugs on the Darknet (December 2014).’ As of 12 June 2016: http://www.digitalcitizensalliance.org/cac/alliance/content.aspx?page=Darknetq42014
Dolliver, D.S. 2015. ‘Evaluation drug trafficking on the Tor Network: Silk Road 2, the sequel.’ International Journal of Drug Policy 26 (11): 1113–1123. doi:10.1016/j.drugpo.2015.01.008
140 Internet-facilitated drugs trade RAND Europe
DrugScope. 2014. ‘Business as usual? A status report on new psychoactive substances (NPS) and ‘club drugs’ in the UK.’ As of 23 June 2016: https://drugscopelegacysite.files.wordpress.com/2015/07/businessasusual.pdf
EMCDDA & Europol. 2013. ‘EU Drug Markets Reports: A strategic analysis.’ As of 23 June 2016: http://www.emcdda.europa.eu/attachements.cfm/att_194336_EN_TD3112366ENC.pdf
EMCDDA. 2009. ‘Annual report 2009: The state of the drug problem in Europe.’ Lisbon: EMCDDA.
EMCDDA. 2011. ‘2011 Annual report on the state of the drugs problem in Europe.’ Lisbon: EMCDDA.
EMCDDA. 2011. ‘Online sales of new psychoactive substances / 'legal highs': summary of results from the 2011 multilingual snapshots.’ Lisbon: EMCDDA.
EMCDDA. 2014. ‘European Drug Report 2014: Trends and developments.’ As of 23 June 2016: http://www.emcdda.europa.eu/publications/edr/trends-developments/2014
EMCDDA. 2015. ‘European Drug Report 2015: Trends and Developments.’ As of 23 June 2016: http://www.emcdda.europa.eu/edr2015
EMCDDA. 2015. ‘The Internet and Drug Markets. Summary of results from an EMCDDA Trendspotter study.’ As of 23 June 2016: http://www.emcdda.europa.eu/publications/technical- reports/internet-drug-markets
Europol. 2014. ‘Organised Crime groups exploiting hidden internet in online criminal service industry.’ As of 23 June 2016: https://www.europol.europa.eu/content/organised-crime-groups-exploiting- hidden-internet-online-criminal-service-industry
Europol. 2015. ‘The Internet Organised Crime Threat Assessment (IOACTA).’ As of 23 June 2016: https://www.europol.europa.eu/content/internet-organised-crime-threat-assessment-iocta-2015
Finklea, K. 2015. ‘Dark Web’. Congressional Research Service.
Global Drugs Survey. 2015. ‘The Global Drug Survey 2015 findings.’ As of 23 June 2016: http://www.globaldrugsurvey.com/the-global-drug-survey-2015-findings/
Gonzalez, D., Ventura, M., Caudevilla, F., Torrens, M. & M. Farre. 2013. ‘Consumption of new psychoactive substances in a Spanish sample of research chemical users.’ Human Psychopharmacology 28 (4): 332–340. doi:10.1002/hup.2323
Gordon, S.M., Forman, R.F. & C. Siatkowski. 2006. ‘Knowledge and use of the Internet as a source of controlled substances.’ Journal of Substance Abuse Treatment 30 (3): 271–274.
Hillebrand, J., D. Olszewski, & R. Sedefov. 2010. ‘Legal Highs on the Internet.’ Substance Use & Misuse 45 (3):330-340. doi:10.3109/10826080903443628.
Home Office. 2014. Drug misuse: findings from the 2013 to 2014 Crime Survey for England and Wales. London: Home Office.
House of Commons Home Affairs Committee. 2013. Drugs: new psychoactive substances and prescription drugs. Twelfth Report of Session 2013-14. London: The Stationery Office Limited.
141 RAND Europe Internet-facilitated drugs trade
INCB. 2001. Globalization and new technologies: challenges to drug law enforcement in the twenty-first century. Annual report of the International Narcotics Control Board. New York: United Nations.
INCB. 2014. Report of the International Narcotics Control Board for 2014. As of 23 June 2016: http://www.incb.org/incb/en/narcotic-drugs/Technical_Reports/narcotic_drugs_reports.html
Jones, A.L. 2002. ‘Legal ‘highs’ available through the Internet-implications and solutions?’ QJM: An International Journal of Medicine 103 (7): 535-536. As of 23 June 2016: http://ro.uow.edu.au/cgi/viewcontent.cgi?article=1183&context=medpapers
Koning, R., R. Niesink. 2013. ‘Nieuw Psychoactieve Stoffen (NPS): niets nieuws onder de zon.’ Verslaving: tijdschrift over verslavingsproblematiek 9: 47-59
Kooistra, Sybren, & Jeroen Trommelen. 2014. ‘Hoe online coffeeshops een miljoenenomzet draaien.’ Volkskrant, 27 September 2014, 06:00. As of 23 June 2016: http://www.volkskrant.nl/vk/nl/2686/Binnenland/article/detail/3757208/2014/09/27/Hoe-online- coffeeshops-een-miljoenenomzet-draaien.dhtml
Lahaie, E., M. Martinez, & A. Cadet-Taïrou. 2013. ‘New psychoactive substances and the Internet: current situations and issues.’ OFDT Tendancies 84: 1-8. As of 23 June 2016: http://en.ofdt.fr/publications/tendances/new-psychoactive-substances-and-Internet-tendances-84- january-2013/
Lavorgna, A. 2014. ‘Internet-mediated drug trafficking: towards a better understanding of new criminal dynamics.’ Trends in Organized Crime 17 (4): 250–270. doi:10.1007/s12117-014-9226-8
Lavorgna, A. 2016. ‘How the use of Internet is affecting drug trafficking practices.’ In The Internet and drug markets, edited by EMCDDA, 85-92. Lisbon: EMCDDA.
Maddox, A., M.J., Barratt, M. Allen, & S. Lenton. 2016. ‘Constructive activism in the dark web: cryptomarkets and illicit drugs in the digital ‘demimonde’.’ Information, Communication & Society 19 (1):111-126. doi:10.1080/1369118X.2015.1093531
Martin, J. 2014. ‘Lost on the Silk Road: online drug distribution and the ‘cryptomarket. Criminology and Criminal Justice 14: 351–367.
Martinez, M. 2015. Learning from the monitoring of NPS popularity on drug users’ forums: The I-TREND experience. Special EMCDDA technical conference, Lisbon 21-22 September 2015, Workshop 6 Internet drug monitoring. As of 23 June 2016: http://www.emcdda.europa.eu/attachements.cfm/att_243610_EN_02.%20M.%20Martinez%20- %20The%20I-TREND%20experience.pdf
Martinez, M. 2014. Drugs on the dark net: how cryptomarkets are transforming the global trade in illict drugs. London: Palgrave Macmillan
Martinez, M., Kmetonyova, D. & V. Belackova. 2016. A method for exploring the number of online shops selling new psychoactive substances: initial I-TREND project results. In The Internet and drug markets, edited by EMCDDA, 97-106. Lisbon: EMCDDA.
142 Internet-facilitated drugs trade RAND Europe
Mounteney, J., P. Griffiths, & L. Vandam. 2016. ‘What future for Internet drug markets?’ In The Internet and drug markets, edited by EMCDDA, 127-134. Lisbon: EMCDDA.
Mounteney, J., A. Oteo, & P. Griffiths. 2016. ‘The Internet and drug markets: shining a light on these complex and dynamic systems.’ In: The Internet and drug markets, edited by EMCDDA, 127-133. Lisbon: EMCDDA.
Nabben, T., A Benschop & D.Korf. 2014. Antenne 2013: Trends in alcohol, tabak en drugs bij jonge Amsterdammers. Rozenberg Publishers: Amsterdam.
Nizar, H., P.I. Dargan, & D.M. Wood. 2015. ‘Using Internet Snapshot Surveys to Enhance Our Understanding of the Availability of the Novel Psychoactive Substance 4-Methylaminorex and 4,4′- Dimethylaminorex.’ Journal of Medical Toxicology 11 (1): 80–84. doi:10.1007/s13181-014-0425-0
Ormsby, Eileen. 2016. ‘Silk Road: insights from interviews with users and vendors.’ In The Internet and drug markets, edited by EMCDDA, 61-68. Lisbon: EMCDDA.
Orsolini, L., G. Francesconi, D. Papanti, A. Giorgetti, & F. Schifano. 2015. ‘Profiling online recreational/prescription drugs' customers and overview of drug vending virtual marketplaces.’ Human Psychopharmacology: Clinical and Experimental 30 (4): 302-318. doi:10.1002/hup.2466
Phelps, A. & A. Watt. 2014. ‘I shop online – recreationally! Internet anonymity and Silk Road enabling drug use in Australia.’ Digital Investigation 11 (4): 261-272.
Raeesi, R. 2015. ‘The Silk Road, Bitcoins and the Global Prohibition Regime on the International Trade in Illicit Drugs: Can this Storm Be Weathered?’ Glendon Journal of International Studies/Revue d'études internationales de Glendon 8 (2): 1-20.
Schifano, F., P. Deluca, L. Agosti, G. Martinotti & J. Corkery. 2005. ‘The Psychonaut Research Group. New Trends in the Cyber and Street Market of Recreational Drugs? The Case of 2C-T-7 (‘Blue Mystic’).' Journal of Psychopharmacology 19: 675-579
Schifano, F., P. Deluca, A. Baldacchino, C. Bonan, A. Comacchio, L. Di Furia, D. Eastwood, M. Farre, S. Ferreira, I. Flores, C. Guionnet, L. Harder, C. Littlejohn, A. Majava, T. Peltoniemi, M. Pizza, C. Prandin, D. Robert, N. Scherbaum, H. Siemann, J. Tarrago, M. Torrens. 2005. The Psychonaut 2002 project: Final report. Brussels: European Commission
Schifano, F., P. Deluca, A. Baldacchino, T. Peltoniemi, N. Scherbaum, M, Torrens, M. Farre, I. Flores, M. Rossi, D. Eastwood, C. Guionnet, S. Rawaf, L. Agosti, L. Di Furia, R. Brigada, A. Majava, H. Siemann, M. Leoni, A. Tomasin, F. Rovetto, F. & A.H. Ghodse. 2006. ‘Drugs on the web; the Psychonaut 2002 EU project.’ Progress in Neuro-Psychopharmacology & Biological Psychiatry 30: 640- 646. doi:10.1016/j.pnpbp.2005.11.035. As of 23 June 2016: http://public- files.prbb.org/publicacions/3553b32f-e0c5-4b8a-bc18-4c8e634263b9.pdf
Schmidt, M.M., A. Sharma, F. Schifano, & C. Feinmann. 2011. ‘“Legal highs” on the net – Evaluation of UK-based websites, products and product information.’ Forensic Science International 206 (1-3): 92-97. doi:10.1016/j.forsciint.2010.06.030
143 RAND Europe Internet-facilitated drugs trade
Seddon, T. 2014. ‘Drug policy and global regulatory capitalism: The case of new psychoactive substances (NPS).’ International Journal of Drug Policy 25: 1019-1024.
Soska, K. & N. Christin. 2015. ‘Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem.’ In Proceedings of the 24th USENIX Security Symposium (USENIX Security'15), 33-48. As of 23 June 2016: https://www.andrew.cmu.edu/user/nicolasc/publications/SC-USENIXSec15.pdf
Stephenson, G. & A. Richardson. 2014. New Psychoactive Substances in England. A Review of the evidence. London: Home Office
Steward, K. 2013. ‘The 21st century’s Silk Road.’ As of 23 June 2016: http://traccc.gmu.edu/wp- content/uploads/2013/06/2013.05.11-Karen-Bentley-Steward-The-21st-Centurys-Silk-Road.pdf
Thanki, D., B. Frederick. 2016. ‘Social media and drug market.’ In The Internet and drug markets, edited by EMCDDA, 115-124. Lisbon: EMCDDA.
The Gallup Organization. 2011. Flash Eurobarometer 330: Youth attitudes on drugs. Analytical report. Brussels: European Commission.
The New Psychoactive Substances Review Expert Panel. 2014. New Psychoactive Substances Review. Report of the Expert Panel. London: Home Office.
TNS Political and Social. 2014. Flash Eurobarometer 401: Young people and drugs. Brussels: European Commission.
Tzanetakis, M., G. Kamphausen, B. Werse, & R. von Laufenberg. 2015. ‘The transparency paradox. Building trust, resolving disputes and optimising logistics on conventional and online drugs markets.’ The International Journal of Drug Policy. doi:10.1016/j.drugpo.2015.12.010.
UNODC. 2010. World Drugs Report 2010. Vienna: United Nations Office on Drugs and Crime
UNODC. 2011. World Drug Report 2011. Vienna, United Nations Office on Drugs and Crime.
UNODC. 2012. World Drug Report 2012. Vienna, United Nations Office on Drugs and Crime.
UNODC. 2014. World Drug Report 2014. Vienna, United Nations Office on Drugs and Crime.
Van Amsterdam, J.G., T. Nabben, D. Keiman, G. Haanschoten, & D. Korf. 2015. ‘Exploring the Attractiveness of New Psychoactive Substances (NPS) among Experienced Drug Users.’ Journal of Psychoactive Drugs 47 (3): 177-181. doi:10.1080/02791072.2015.1048840
Van Buskirk J., A. Roxburgh, R. Bruno, & L. Burns. 2013. Drugs and the Internet, Issue 1. Sydney: National Drug and Alcohol Research Centre.
Van Buskirk, J., Roxburgh, A., Farrell, M. and Burns, L. 2014. ‘The closure of the Silk Road: what has this meant for online drug trading?’ Addiction 109: 517–518.
Van Hout, M. C. & T. Bingham. 2013. ‘Surfing the Silk Road’: a study of users' experiences.’ International Journal of Drug Policy 24 (6): 524–529. doi:10.1016/j.drugpo.2013.08.011
144 Internet-facilitated drugs trade RAND Europe
Van Hout, M.C. & T. Bingham. 2013. ‘Silk Road', the virtual drug marketplace: A single case study of user experiences.’ International Journal of Drug Policy 24 (5): 385–391. doi:10.1016/j.drugpo.2013.01.005
Van Hout, M.C. & T. Bingham. 2014. ‘Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading.’ International Journal of Drug Policy 25 (2): 183-189. doi:10.1016/j.drugpo.2013.10.009
Van Laar, M.W. & M.M.J. Van Ooyen-Houben. 2014. Nationale Drug Monitor Jaarbericht 2013/2014. Utrecht: Trimbos-Instituut, Den Haag: WODC
Van Laar, M.W. & M.M.J. Van Ooyen-Houben. 2015. Nationale Drug Monitor Jaarbericht 2015. Utrecht: Trimbos-Instituut, Den Haag: WODC
Van Slobbe, J. 2016. ‘The drugs trade on the deep web: a law enforcement perspective.’ In The Internet and drug markets, edited by EMCDDA, 77–84. Lisbon: EMCDDA.
Vardakou, I., C. Pistos, & Ch. Spiliopoulou. 2011. ‘Drugs for youth via Internet and the example of mephedrone.’ Toxicology Letters 201 (3): 191–195. doi:10.1016/j.toxlet.2010.12.014
Vento, A.E., G. Martinotti, E. Cinosi, M. Lupi, T. Acciavatti, D. Carrus, R. Santacroce, E. Chillemi, L. Bonifaci, M. di Giannantonio, O. Corazza & F. Schifano. 2014. ‘Substance Use in the Club Scene of Rome: A Pilot Study.’ In Novel Psychoactive Substances and Behavioral Addictions, edited by Martinotti,G., O. Corazza, S. Achab & Z. Demetrovics, 1-7. Cairo: Hindawi Publishing Corporation.
Other relevant literature68 Aldridge, J. & R. Askew. 2016. ‘When drug dealers can advertise: how drug cryptomarkets enable drug dealers to advertise.’ Presented at the 10th Annual Conference of the International Society for the Study of Drug Policy, Sydney.
Aldridge, J. & D. Décary-Hétu. 2015. ‘A response to Dolliver's "Evaluating drug trafficking on the Tor Network: Silk Road 2, the sequel”.’ International Journal on Drug Policy 26 (11): 1124-1125. doi:10.1016/j.drugpo.2015.05.017
Aldridge, J. & D. Décary-Hétu. 2015. ‘Cryptomarkets: The Dark Net as Online Market Innovation.’ Final Report to NESTA, UK.
Aldridge, J., A. Stevens, & M. Barratt. 2016. ‘A research agenda for assessing harms and benefits related to cryptomarket drug trading.’ Presented at the 10th Annual Conference of the International Society for the Study of Drug Policy, Sydney.
68 These articles were relevant for the studied topic, yet not included for detailed analysis in NVivo. Note that some of these articles were included in the final version of the report. Some were not included for various reasons (e.g. they were still ‘forthcoming’ during the period in which the current study was conducted, or they were published long after the literature analysis was completed). However, given the relevance of these articles for the studied topic, they are included here for further reference. News items are not included in this list (unless it regarded investigative journalism).
145 RAND Europe Internet-facilitated drugs trade
Aldridge, J. & D. Décary-Hétu. 2016a. ‘Hidden Wholesale: The drug diffusing capacity of online drug cryptomarkets.’ The International Journal of Drug Policy. doi: 10.1016/j.drugpo.2016.04.020.
Barratt, M., J.A. Ferris, & A.R. Winstock. 2016a. ‘Safer scoring? Cryptomarkets, social supply and drug market violence.’ The International Journal of Drug Policy. doi:10.1016/j.drugpo.2016.04.019
Barratt, M., S. Lenton, A. Maddox, & M. Allen. 2016. ‘‘What if you live on top of a bakery and you like cakes?’—Drug use and harm trajectories before, during and after the emergence of Silk Road.’ The International Journal of Drug Policy S0955-3959 (16): 30098-6. doi:10.1016/j.drugpo.2016.04.006.
Bernaards, F., E. Monsma, & P. Zinn. 2012. High Tech Crime: Criminaliteitsbeeldanalyse 2012. Driebergen: Korps Landelijke Politiediensten (KLPD), Dienst Nationale Recherche
Bieleman, B., R. Mennes, & M. Sijtstra. 2015. Coffeeshops in Nederland 2014: Aantallen coffeeshops en gemeentelijk beleid 1999-2014. Groningen-Rotterdam: Bureau Intraval.
Bitcoinhelp.net. 2016. ‘Bitcoin Price Chart with Historic Events.’ Bitcoinhelp.net, 3 November. As of 23 June 2016: https://bitcoinhelp.net/know/more/price-chart-history
Boivin, R. 2014. ‘Risks, prices, and positions: A social network analysis of illegal drug trafficking in the world-economy.’ International Journal of Drug Policy 25 (2): 235-243. doi:10.1016/j.drugpo.2013.12.004
Broséus, J., D. Rhumorbarbe, C. Mireault, V. Ouellette, F. Crispino, & D. Décary-Hétu. 2016. ‘Studying illicit drug trafficking on Darknet markets: structure and organisation from a Canadian perspective.’ Forensic Science International 264: 7-14. doi:10.1016/j.forsciint.2016.02.045
Buwalda, M. & N. Kwakman. 2014. ‘Het ontwerp wetsvoorstel Computercriminaliteit III.’ Ars Aequi63(1): 9-17. As of 12 June 2016: http://www.rug.nl/research/portal/files/13789865/AA20140009.pdf
Cadet-Taïrou, A., E. Lahaie & M. Martinez. Forthcoming. Internet Tools for Research in Europe on New Drugs (I-TREND): interdisciplinary and integrated approaches to substances, users and markets. Workstream 3: Online survey for people who use new psychoactive substances. French national survey report. I-TREND
Caudevilla, F., M. Ventura, I. Fornis, M. Barratt, C. Vidal, C. Iladanosa, P. Quintana, A. Muñoz & N. Calzada. 2016. ‘Results of an international drug testing service for cryptomarket users.’ The International Journal of Drug Policy. doi:10.1016/j.drugpo.2016.04.017
Council of the European Union. 2010. Council Conclusions of 25 October 2010 on the creation and implementation of an EU Policy Cycle for organised and serious international crime (doc. 15358/10).
Cyber Experts Blog at National Cybersecurity Institute. 2015. ‘Encryption: The Backbone of Cybersecurity Strategies.’ As of 12 June 2016: http://www.nationalcybersecurityinstitute.org/editorials/encryption-the-backbone-of-cybersecurity- strategies/
Décary-Hétu, D. & J. Aldridge. 2013. DATACRYPTO: The Dark Net Crawler and Scraper.
146 Internet-facilitated drugs trade RAND Europe
Décary-Hétu, D., M. Paquet-Clouston, & J. Aldridge. Forthcoming. ‘Going international. Risk taking and the willingness to ship internationally among drug cryptomarket vendors.’ International Journal of Drug Policy.
Del Río, M. C., C. Prada, & F.J. Alvarez. 2002. ‘Drinking habits throughout the seasons of the year in the Spanish population.’ Journal of Studies on Alcohol 63 (5): 577-580.
Dolliver, D.S. & J.L. Kenney. 2016. ‘Characteristics of Drug Vendors on the Tor Network: A Cryptomarket Comparison.’ Victims & Offenders. An International Journal of Evidence-based Research, Policy, and Practice 00: 1-21. doi:10.1080/15564886.2016.1173158
Druginfo. 2015. ‘New psychoactive substances (synthetics) facts.’ As of 23 June 2016: http://www.druginfo.adf.org.au/drug-facts/legal-highs
EMCDDA. 2015. ‘Perspectives on drugs: Legal approaches to controlling new psychoactive substances.’ As of 23 June 2016: http://www.emcdda.europa.eu/topics/pods/controlling-new-psychoactive- substances
EMCDDA, 2016. ‘European Drug Report. Trends and developments,’ Lisbon: EMCDDA. As of 12 June 2016: http://www.emcdda.europa.eu/publications/edr/trends-developments/2016
EMCDDA. 2016. ‘The Internet and drug markets, EMCDDA Insights 21.’ Lisbon: EMCDDA.
EMCDDA & Europol. 2015. ‘EU Drug Markets Report: In-Depth Analysis.’ Lisbon: EMCDDA, Europol.
EMCDDA & Europol. 2016. ‘EU Drug Markets Report: In-Depth Analysis.’ Lisbon: EMCDDA, Europol.
Europol. 2014. ‘Global action against dark markets on TOR network.’ As of 23 June 2016: https://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network
Europol. 2014. ‘The Internet Organised Crime Threat Assessment (iOCTA).’ As of 23 June 2016: https://www.europol.europa.eu/content/internet-organised-crime-threat-assesment-iocta
Europol & EMCDDA. 2012. ‘EMCDDA-Europol 2011 Annual Report on the implementation of Council Decision 2005/387/JHA : In accordance with Article 10 of Council Decision 2005/387/JHA on the information exchange, risk-assessment and control of new psychoactive substances.’ Lisbon: EMCDDA
Federal Ministry of the Interior. 2015. ‘JICDT-VM Darknet Project.’ As of 23 June 2016: http://www.bmi.gv.at/cms/BK/publikationen/files/552015_Broschre_Darknet_Project_Web.pdf
Gwern. 2016. Tor Black-Market-related Arrests. As of 23 June 2016: https://www.gwern.net/Black-market%20arrests
Hutchings, A., R. Clayton, & R. Anderson. in press. ‘Taking Down Websites to Prevent Crime.’ Toronto: eCrime. As of 23 June 2016: https://www.cl.cam.ac.uk/~ah793/papers/2016takedown.pdf
147 RAND Europe Internet-facilitated drugs trade
Katsuki, T., T.K. Mackey, & R. Cuomo. 2015. ‘Establishing a Link Between Prescription Drug Abuse and Illicit Online Pharmacies: Analysis of Twitter Data.’ Journal of Medical Internet Research 17 (12): e280. doi:10.2196/jmir.5144
KLPD. 2013. Witwassen. Criminaliteitsbeeldanalyse 2012. Driebergen: Korps landelijke politiediensten.
Kmetonyová, D. & M. Pažitný. Forthcoming. Workstream 2: Monitoring of Online Shops Full report. Prague: Department of Addictology, First Faculty of Medicine, Charles University in Prague and General Teaching Hospital in Prague
Koops, B-J., & M. Goodwin. 2014. ‘Cyberspace, the cloud, and cross-border criminal investigation: the limits and possibilities of international law.’ Tilburg/Den Haag: Tilburg University - TILT Tilburg Institute for Law, Technology, and Society/ WODC.
Krauss, M.J., S.J. Sowles, S. Mylvaganam, K. Zewdie, L.J. Bierut, & P.A. Cavazos-Rehg (2015) ‘Displays of dabbing marijuana extracts on YouTube.’ Drug & Alcohol Dependence 155: 45–51. doi:10.1016/j.drugalcdep.2015.08.020
Lai, F. Y., P.K. Thai, J. O'Brien, C. Gartner, R. Bruno, B. Kele, B., C. Ort, J. Prichard, P. Kirkbride, W. Hall, S. Carter & J.F. Mueller. 2013. ‘Using quantitative wastewater analysis to measure daily usage of conventional and emerging illicit drugs at an annual music festival.’ Drug and Alcohol Review 32 (6): 594-602. doi:10.1111/dar.12061
Lewman, A. 2016. ‘Tor and links with cryptomarkets.’ In The Internet and drug markets, edited by EMCDDA, 33-40. Lisbon: EMCDDA.
Mackey, T.K. & B.A. Liang. 2013. ‘Global Reach of Direct-to-Consumer Advertising Using Social Media for Illicit Online Drug Sales.’ Journal of Medical Internet Research 15 (5): e105. doi:10.2196/jmir.2610
Mahapatra, Ananya & Pawan Sharma. 2016. ‘Internet snapshot survey: A novel methodology to monitor novel psychotropic substances and its need in Asia’, Asian Journal of Psychiatry 21: 7-8. doi.org/10.1016/j.ajp.2016.01.014.
Martinez, M., A. Atkinson, E. Begley, V. Běláčková, E. Drapalova, D. van der Gouwe, M. Kidawa and M. Jabłońska. Forthcoming. Workstream 1: Forums Monitoring Full Report. Saint-Denis: Observatoire Français des Drogues et des toxicomanies
Maxwell, S. & D. Webb 2008. Internet pharmacy: a web of mistrust? British Journal of Clinical Pharmacology 66 (2): 196-198.doi:10.1111/j.1365-2125.2008.03215.x
May, T. & M. Hough. 2004. ‘Drug markets and distribution systems.’ Addiction Research and Theory 12 (6): 549-563.
Ministerie van Veiligheid en Justitie. 2014. Beantwoording Kamervragen over online drugs kopen. As of 23 June 2016 : https://www.rijksoverheid.nl/onderwerpen/drugs/documenten/kamerstukken/2014/07/03/antwoorde n-kamervragen-over-online-drugs-kopen
148 Internet-facilitated drugs trade RAND Europe
Moore, T. & N. Christin. 2013. Beware the middleman: Empirical analysis of Bitcoin-‐exchange risk. International Conference on Financial Cryptography and Data Security. Berlin Heidelberg : Springer.
Morselli, C., D. Decary-Hetu, M. Paquet-Clouston, & J. Aldridge. Under review. What Am I Going To Do, Shoot Him? Conflict Management in the Age of Drug Cryptomarkets, Journal of Conflict Resolution.
Munksgaard, R. and Demant J. 2016. ‘A replication and methodological critique of the study ‘Evaluating drug trafficking on the Tor Network”’. The International Journal of Drug Policy. doi: As of 23 June 2016 : http://dx.doi.org/10.1016/j.drugpo.2016.02.027
National Institute on Drug Abuse. 2014. ‘What are opioids?’ As of 23 June 2016: https://www.drugabuse.gov/publications/research-reports/prescription-drugs/opioids/what-are- opioids
National Institute on Drug Abuse. 2014. ‘What are stimulants?’ As of 23 June 2016: https://www.drugabuse.gov/publications/research-reports/prescription-drugs/stimulants/what-are- stimulants
Norman, J., S. Grace & C. Lloyd. 2014. ‘Legal high groups on the internet – The creation of new organized deviant groups?’ Drugs: Education, Prevention and Policy 21: 14-23.69
OpenBazaar. 2016. OpenBazaar is open for Business. Blog post. As of 23 June 2016: https://blog.openbazaar.org/openbazaar-is-open-for-business/
Openbaar Ministerie. 2014. ‘Reactie Openbaar Ministerie op het Volkskrant-onderzoek naar omvang en groei Nederlandse online drugsverkoop.’ As of 23 June 2016 : http://static3.volkskrant.nl/static/asset/2014/Reactie_Openbaar_Ministerie_6685.pdf
Openbaar Ministerie. 2014. ‘Undercover onderzoek naar illegale marktplaatsen op internet.’ As of 23 June 2016 : https://www.om.nl/vaste-onderdelen/zoeken/@32626/undercover-onderzoek/
Ormsby, E. 2012. ‘Silk road: The eBay of illegal drugs, Kill your darlings’ 11 (October 2012).70
Rijksoverheid. 2015. Wetsvoorstel Computercriminaliteit bij Tweede Kamer ingediend. As of 23 June 2016: https://www.rijksoverheid.nl/actueel/nieuws/2015/12/22/wetsvoorstel-computercriminaliteit-bij- tweede-kamer-ingediend
Sałustowicz, P., A. Malczewski, V. Belackova, T Brunt, A. Cadet Tairou, M. Jabłońska, E. Lahaie & S. Mandes. Forthcoming. Internet Tools for Research in Europe on New Drugs (I-TREND): interdisciplinary and integrated approaches to substances, users and markets. Workstream 3: Online survey for people who use new psychoactive substances. International survey report. I-TREND
Shy, Oz. 2001. The Economics of Network Industries. Cambridge: Cambridge University Press.
69 This article could not be accessed by the study team. 70 This article could not be accessed by the study team.
149 RAND Europe Internet-facilitated drugs trade
Soska, K., A. Kwon, N. Christin, & S. Devadas. 2016. ‘Beaver: A Decentralized Anonymous Marketplace with Secure Reputation.’ [Eprint ahead of publication]. As of 23 June 2016: https://eprint.iacr.org/2016/464.pdf
Spapens, T., T. Müller, & H. Bunt. 2014. ‘The Dutch Drug Policy from a Regulatory Perspective.’ European Journal on Criminal Policy and Research 21 (1): 191-205.
Trautmann, F. 2016. Expert Meeting on Internet and Drugs. Background Paper. [Background paper as prepared at the request of the European Commission, DG Migration and Home Affairs, Anti-drug policy unit.]
Tweede Kamer der Staten-Generaal. 2012/2013. Drugsbeleid. Kamerstukken II 2012/13, 24077, nr.295
Tweede Kamer der Staten-Generaal 2014/2015. Drugsbeleid. Kamerstukken II 2014/15, 24077, nr.355
Van Buskirk J., A. Roxburgh, R. Bruno, & L. Burns. 2014. Drugs and the Internet, Issue 4. Sydney: National Drug and Alcohol Research Centre.
Van Buskirk, J., A. Roxburgh, S. Naicker, & L. Burns. 2015. ‘A response to Dolliver's “Evaluating drug trafficking on the Tor network”.’ International Journal of Drug Policy 26 (11): 1126–1127. doi:10.1016/j.drugpo.2015.07.001
Van Buskirk, J., A. Roxburgh, R. Bruno, , S. Lenton, R. Sutherland, E. Whittaker, N. Sindicich, A. Matthews, K. Butler, K. & L. Burns. 2016. ‘Characterising dark net marketplace purchasers in a sample of regular psychostimulant users.’ The International Journal of Drug Policy. doi:10.1016/j.drugpo.2016.01.010
Vemette-Marcotte, A.E., P.I. Dargan, J.R.H. Archer, S. Gosselina & D.M. Wood. 2014. ‘An Internet snapshot study to compare the international availability of the novel psychoactive substance methiopropamine,’ Clinical Toxicology 52: 678-681.71
Villasenor, J., C. Monk, & C. Bronk. 2011. ‘Shadowy figures: tracking illicit financial transactions in the murky world of digital currencies, peer-to-peer networks, and mobile device payments.’ Brookings Institution.
Volery, R. 2015. Vente de drogues sur les cryptomarchés: techniques d’envoi et transmission des connaissances. [Master’s thesis] Lausanne: School of Criminal Sciences, Univesité de Lausanne.
Excluded72 Aldridge, J., Measham, F., & L. Williams. 2011. Illegal Leisure Revisited: Changing Patterns of Alcohol and Drug Use in Adolescents and Young Adults. London: Routledge.
71 This article could not be accessed by the study team. 72 These references were excluded for analysis. However, some items were used as background material in this report. News items are not included in this list (unless it regarded investigative journalism).
150 Internet-facilitated drugs trade RAND Europe
Bancroft, A., & P.S. Reid. 2015 ‘Concepts of illicit drug quality among darknet market users: Purity, embodied experience, craft and chemical knowledge.’International Journal of Drug Policy. doi : 10.1016/j.drugpo.2015.11.008
Barratt, M. J., S. Lenton & M. Allen. 2013. ‘Internet content regulation, public drug websites and the growth in hidden Internet services.’ Drugs Educ Prev Policy 20: 195–202
Barratt, M.J. 2011. Discussing illicit drugs in public internet forums: Visibility, stigma, and pseudonymity. Proceedings of the 5th International Conference on Communities and Technologies. ACM, 159-168.
Barratt, M.J. 2012. ‘The efficacy of interviewing young drug users through online chat.’ Drug and Alcohol Review 31: 566-572
Bastianic, T., A-C Brisacier, A. Cadet-Taïrou, S. Dambélé, C. Díaz Gómez, M. Gandilhon,E. Lahaie, O. Le Nézet, A. Lermenier, M. Martinez, M. Milhet, C. Mutatayi, I. Obradovic, C. Palle, M. Pousset, & M-L. Tovar. 2013. Drogues et addictions, données essentielles. Saint Denis La Plaine Cedex: OFDT.
Bego, K & J. Bland. 2015. Crawling the dark web: the economics of online drug markets. As of 23 June 2016: http://www.nesta.org.uk/blog/crawling-dark-web-economics-online-drug- markets#sthash.TBYDiiLd.dpuf. As of 23 June 2016: http://www.nesta.org.uk/blog/crawling-dark- web-economics-online-drug-markets
Bell, D. 2006. An introduction to cybercultures. London: Routledge
Bindhim, N. F., S. Naicker, B. Freeman, K. McGeechan & L. Trevena. 2014. ‘Apps promoting illicit drugs: a need for tighter regulation?’ Journal of Consumer Health on the Internet 18:31–43.
Bingham, T. 2014. Drugs & the dark net. Bray Drugs Awareness Conference, 26th November 2014.
Biryukov, A., I. Pustogarov, & R-F. Weinmann. 2013. Content and popularity analysis of Tor hidden services. arXiv:1308.6768 [cs.CR]
Bitcoin. 2011. ‘Bitcoin P2P Digital Currency.’ As of 23 June 2016: http://bitcoin.org (archived at http://www.webcitation.org/62jqFO2p8).
Bitcoin charts. 2013. ‘Bitcoin charts.’ As of 23 June 2016: http://bitcoincharts.com
Blain, L. 2013. ‘300 million dollars out of thin air.’ Gizmag website. As of 23 June 2016: http://www.gizmag.com/bitcoin-creation-value-overview/26325/
Brandt, S.D., H.R. Sumnall, F. Measham & J. Cole. 2010. ‘Analyses of secondgeneration ‘legal highs’ in the UK: Initial findings.’ Drug Testing and Analysis 2 (8): 377-382.
Branwen, G. 2014. ‘2014 in DNMs: by the numbers.’ As of 23 June 2016: http://www.reddit.com/r/DarkNetMarkets/comments/2r58vs/2014_in_dnms_by_the_ numbers/
Britz, M. 2008. ‘A new paradigm in organized crime in the United States: criminal syndicates, cybergangs, and the World Wide Web.’ Social Compass 2: 1750–1756.
Callemien, M. 2002. Attitudes and opinions of young people in the European Union on drugs. Eurobarometer 57.2. Brussels: European Commission
151 RAND Europe Internet-facilitated drugs trade
Castronova, J. R. 2006. ‘Operation cyber chase and other agency efforts to control internet drug trafficking the ‘‘virtual’’ enforcement initiative is virtually useless.’ Journal of Legal Medicine 27 (2): 207–224.
Caudevilla, F. 2016. ‘The emergence of deep web marketplaces: a health perspective.’ In The Internet and drug markets, edited by EMCDDA, 69-76. Lisbon: EMCDDA.
Cavazos-Rehg, P., M. Krauss, R. Grucza, & L. Bierut. 2014, ‘Characterizing the followers and tweets of a marijuana-focused Twitter handle.’ Journal of Medical Internet Research 16 (6): e157. doi:10.2196/jmir.3247
Chen, H. 2011. Dark web: Exploring and data mining the dark side of the web. New York : Springer Science & Business Media
Cho, Y.I., T.P. Johnson, & M. Fendrich. 2001. ‘Monthly variations in self-reports of alcohol consumption.’ Journal of Studies on Alcohol 62 (2): 268-272. doi:10.15288/jsa.2001.62.268
Christin, N. 2014. ‘Commentary on Barratt et al. (2014): Steps towards characterizing online anonymous drug marketplace customers.’ Addiction 109 (5): 784–785.
Corazza, C., F. Saverio Bersani, R. Brunoroa, G. Valeriani, G. Martinottid & F. Schifano. 2014. ‘The diffusion of Performance and Image Enhancing Drugs (PIEDs) on the internet: The abuse of the cognitive enhancer Piracetam.’ Substance Use & Misuse 49 (14):1849–1856.
Corazza, O., S. Assi, G. Trincas et al. 2011. ‘Novel drugs, novel solutions: exploring the potentials of web-assistance and multimedia approaches for the prevention of drug abuse.’ Italian Journal on Addiction 1: 1-2.
Corazza, O., F. Schifano, M. Farre, P. Deluca, Z. Davey, C. Drummond et al. 2011. ‘Designer drugs on the internet: A phenomenon out-of-control? The emergence of Hallucinogenic drug bromo- dragonfly.’ Current clinical Pharmacology 6: 125–129.
Corazza, O., F. Schifano, P. Simonato, S. Fergus, S. Assi, J. Stair et al. 2012. ‘Phenomenon of new drugs on the internet: The case of ketamine derivative methoxetamine. Human Psychopharmacology: Clinical and Experimental ‘27: 145-149.
Council of the European Union and Krecké, J. 2005. Council Decision 2005/387/JHA of 10 May 2005 on the information exchange, risk-assessment and control of new psychoactive substances. OJEU, no. L 127 of 20 May 2005
Davey, Z., O. Corazza, F. Schifano, P. Deluca & Psychonaut Web Mapping Group. 2010. ‘Mass- information: Mephedrone, myths, and the new generation of legal highs.’ Drugs and Alcohol Today 10: 24–28.
Davey, Z., F. Schifano, O. Corazza & P. Deluca. 2012. ‘E-Psychonauts: Conducting research in online drug forum communities.’ Journal of Mental Health 21: 386-394.
Davies, B. 2012. ‘Dangerous Drugs Online.’ The Australian Prescriber 35 : 32–33.
Davis, J. 2010. ‘The Crypto-Currency.’ In The New Yorker. New York: Condé Nast.
152 Internet-facilitated drugs trade RAND Europe
Décary-Hétu, D. 2013. Le capital virtuel: entre competition, survie et reputation. University of Montreal
Décary-Hétu, D., B. Dupont & F. Fortin. 2014. ‘Policing the Hackers by Hacking Them: Studying Online Deviants in IRC Chat Rooms.’ In Networks and Network Analysis for Defence and Security, edited by A.J. Masys. Switzerland: Springer.
Devine, J., F. Egger-Sidera & A. Rojasa. 2015. ‘The Evolving Impact of the Invisible Web: Exploring Economic and Political Ramifications.’ Journal of Web Librarianship 9 (4):145-161.
Dingledine, R., N. Mathewson & P. Syverson. 2004. Tor: The second-generation onion router. DTIC Online: Information for the Defence Community: Naval Research Lab Washington DC
Duffy, C. 2012. ‘Dealers shed light on dark internet’s drug trade.’ ABC News website. As of 23 June 2016: http://www.abc.net.au/news/2012-12-05/dark-internet-linked-to-drug-seizure-spike/4410872
EMCDDA. 2015. ‘Summary: Drug market dynamics in Europe: global influences and local differences.’ As of 12 June 2016: http://www.emcdda.europa.eu/publications/edr/trends- developments/2015/online/summary
Eurojust. 2015. Implementation Report of the Action Plan on Drug Trafficking. As of 23 June 2016: http://www.eurojust.europa.eu/doclibrary/eurojust- framework/caseworkdrugtraffickingactionplan2015/implementation%20report%20of%20the%20act ion%20plan%20on%20drug%20trafficking%20(january%202015)/drug-trafficking-report_2015- 01-16_en.pdf
Europol. 2011. Internet facilitated organized crime (IOCTA) (abridged). The Hague: Europol
Europol. 2013. SOCTA 2013 Public Version. The Hague: Europol
Fallmann, H., G. Wondracek, & C. Platzer. 2010. ‘Covertly probing underground economy marketplaces’. In . Detection of Intrusions and Malware, and Vulnerability Assessment, edited by C. Kreibich & M. Jahnke. Berlin: Springer.
Forman, R. F., D.B. Marlowe, A.T. McLellan. 2006. ‘The Internet as a source of drugs of abuse.’ Current Psychiatry Reports 8:377–382.
Forsyth, A.J. 2012. ‘Virtually a drug scare: mephedrone and the impact of the internet on drug news transmission.’ International Journal of Drug Policy 23 (3) : 198-209.
Franklin, J., V. Paxson, A. Perrig & S. Savage. 2007. ‘An inquiry into the nature and causes of the wealth of internet miscreants.’ In: Proceedings of the 14th ACM Conference on Computer and Communications Security. As of 23 June 2016: http://dl.acm.org/citation.cfm?id=1315292
Fu, T., Abbasi, A. and Chen, H. 2010. ‘A focused crawler for Dark Web forums.’ Journal of the Association for Information Science and Technology 61: 1213–1231.
Fuller, E. & V. Hawkins. 2014. Smoking, drinking and drug use among young people in England in 2013. As of 23 June 2016: http://www.hscic.gov.uk/catalogue/PUB14579/smok-drin-drug-youn-peop-eng- 2013-rep.pdf
153 RAND Europe Internet-facilitated drugs trade
Griffiths, P., M. Evans-Brown & R. Sedefov. 2013. ‘Getting up to speed with the public health and regulatory challenges posed by new psychoactive substances in the information age,’ Addiction 108: 1700–3.
Griffiths, P., L. Vingoe, N. Hunt, J. Mounteney, & R. Hartnoll, 2000. ‘Drug Information Systems, Early Warning, and New Drug Trends: Can Drug Monitoring Systems Become More Sensitive to Emerging Trends in Drug Consumption?’ Substance use & misuse 35: 811-844.
Gustavaaon, D. & C. Escher. 2009. ‘Mephedrone: internet drug which seems to have come and stay. Fatal cases in Sweden have drawn attention to previously unknown substance [in Swedish].’ Lakartidningen 106: 2769–71.
Hamby, D., A. Burnett, M. Jablonsky, B. Twamley, P.V. Kavanagh, E.A. Gardner. 2015. ‘Identification of 2-(ethylamino)-1-(4-methylphenyl)-1-pentanone (4-MEAP), a New "Legal High" Sold by an Internet Vendor as 4-Methyl Pentedrone.’ Journal of Forensic Sciences 60 (3): 721-6.
Hodson, H. 2013. ‘Silk Road bust hints at FBI’s new cybercrime powers.’ New Scientist (1971) 220: 22.
Hoe, S. C., M. Kantarcioglu, & A. Bensoussan, A. 2012. ‘A game theoretical analysis of lemonizing cybercriminal black markets.’ In Decision and Game Theory for Security, edited by J. Grossklags and J. Walrand, 60-77. Berlin Heidelberg: Springer.
Holt, T.J. 2010. ‘Exploring Strategies for Qualitative Criminological and Criminal Justice Inquiry Using On‐Line Data.’ Journal of Criminal Justice Education 21: 466-487.
Holt, T.J., O. Smirnova,D. Strumsky & M. Kilger. 2014. ‘Advancing Research on Hackers Through Social Network Data.’ In Social Networking as a Criminal Entreprise, edited by C.D. Marcum and G.E. Higgins. Boca Raton: Taylor Francis.
Holta, T.J., O. Smirnovab, Y.T. Chuaa & H. Copesc. 2015. ‘Examining the risk reduction strategies of actors in online criminal markets.’ Global Crime 16(2):81-103.
INCB. 2014. Precursors and chemicals frequently used in the illicit manufacture of narcotic drugs and psychotropic substances. Available from : INCB website. As of 23 June 2016 : http://www.incb.org/incb/en/precursors/technical_reports/precursors-technical-reports.html
INCB. 2014. Psychotropic Substances. Statistics for 2013. INCB website. As of 23 June 2016 : http://www.incb.org/incb/en/psychotropic-substances/technical_reports/technical_reports-index.html
INCB. 2015. Narcotic Drugs. Technical Report. INCB website. As of 23 June 2016 : http://www.incb.org/incb/en/narcotic-drugs/Technical_Reports/narcotic_drugs_reports.html
Inciardi, J. A., H. L. Surratt, T. J. Cicero, A. Roseblum, C. Ahwah, E. Bailey et al. 2010. ‘Prescription drugs purchased through the internet: Who are the end users?’ Drug and Alcohol Dependence 110 : 21–29.
Interpol. 2012. Drug Trafficking. COM/FS/2012-02/DCO-01
Jeffray, C. & T. Feakin. 2015. Underground web: the cybercrime challenge. Barton: Australian Strategic Policy Institute
154 Internet-facilitated drugs trade RAND Europe
Johnson, B. 2014. The advantages and disadvantages of the deep web, Tor network, virtual currencies and the regulatory challenges thereof. As of 23 June 2016 : http://search.proquest.com/docview/1645951956
Kleiman, J.A. 2013. ‘Beyond the Silk Road: Unregulated Decentralized Virtual Currencies Continue to Endanger US National Security and Welfare.’ National Security Law Brief 4(1):59-78.
Koops, E.J. 2012. ‘De dynamiek van cybercrimewetgeving in Europa en Nederland.’ Justitiële verkenningen 38(1), 9-24.
Lavorgna, A. 2015. ‘Organised crime goes online: Realities and challenges.’ Journal of Money Laundering Control 18(2): 153-168.
Leontiadis, N., T. Moore, & N. Christin. 2011. Measuring and analyzing search-redirection attacks in the illicit online prescription drug trade. Proc. USENIX Security’11, San Francisco, CA, Aug. 2011.
Leontiadis, N., T. Moore & N. Christin. 2013. Pick your poison: pricing and inventories at unlicensed online pharmacies. Proceedings of the 14th ACM conference on Electronic Commerce, June 16–20, 2013, Philadelphia, Pennsylvania, USA. New York: ACM. pp. 621–38. As of 23 June 2016: http://www.andrew.cmu.edu/user/nleontia/LMC-EC13.pdf (archived at http://www.webcitation.org/6LWgPrILg).
Local Government Association. 2015. A councillors' guide to tackling new psychoactive substances. As of 23 June 2016: http://www.local.gov.uk/web/guest/publications/- /journal_content/56/10180/6876239/PUBLICATION
Mackey, T. K., & B. A. Liang. 2011. ‘Promoting online drug safety: Using public–private partnership to deter illicit online drug sales.’ Journal of Commercial Biotechnology. 17(3), 266–271.
Manky, D. 2013. ‘Cybercrime as a service: a very modern business.’ Computer Fraud & Security 6: 9-13.
Mann, D. & M. Sutton. 1998. ‘NETCRIME: More Change in the Organization of Thieving.’ British Journal of Criminology 38: 201-229.
Maras, M.H. 2014. ‘Inside Darknet: the takedown of Silk Road.’ Criminal Justice Matters 98(1):22-23.
Martin, J. 2013. Beyond Silk Road: How Online Illicit Marketplaces are Challenging Law Enforcement and Transforming the Global Trade in Illicit Drugs. Thinking Globally about Crime and Justice Seminar Series, University of Hong Kong, Hong Kong SAR.73
Martin, J. 2013. High Online: Analysing The Rise and Rise of The Illicit Drugs Website, Silk Road. British Society of Criminology Conference, University of Wolverhampton, UK.74
Martin, J. 2013. Silk Road: The New Digital Front in The Global War on Drugs. Australian Critical Criminology Conference, Flinders University, Australia.75
73 This article could not be accessed by the study team. 74 This article could not be accessed by the study team. 75 This article could not be accessed by the study team.
155 RAND Europe Internet-facilitated drugs trade
Martin, J. 2014. Drug Dealing on the Dark Net: How Cyber Offenders are Explanding the Online Trade in Illicit Drugs. Australian and New Zealand Society of Criminology Conference, University of Sydney.76
Martin, J. 2014. Fair trade' opium and 'conflict free' cocaine: Online drug dealing and cryptomarket competition in the post-Silk Road era. British Society of Criminology Conference, University of Liverpool, UK.77
Martin, J. 2014. Online vs. Conventional Drug Distribution Networks. International Illicit Networks Workshop, Flinders University
Martin, J. 2015. Criminology on the Digital Frontier: Methods and Ethics in Cryptomarket Research. British Society of Criminology Conference, Plymouth University, UK
Martin, J. 2015. New Psychoactive Substances and the Dark Net: The Rise of Cryptomarket-facilitated Drug Trading. ESRC Seminar Series: The Psychoactive Substances Bill, Law Enforcement and NPS in Prison: Problems and Solutions, University of Leicester, UK
Martin, J. 2015. ‘The bright side of the dark net.’ Ethics Quarterly 99 (Autumn 2015): 5-7.
May, T. 1994. ‘Crypto Anarchy and Virtual Communities’. As of 23 June 2016 : http://groups.csail.mit.edu/mac/classes/6.805/articles/crypto/cypherpunks/may-virtual-comm.html
McCoy, D. K. Bauer & D. Grunwald, T. Kohno, & D. Sicker. 2008. Shining light in dark places: Understanding the tor network. PETS’08, Leuven, Belgium, July 2008.
McCoy, D.,H. Dharmdasani, C. Kreibich, G. Voelker & S. Savage. 2012. Priceless: The role of payments in abuse-advertised goods. ACM CCS’12, Raleigh, NC, Oct. 2012.
McCoy, D., A. Pitsillidis, G. Jordan, N. Weaver, C. Kreibich, B. Krebs, G. Voelker, S. Savage & K. Levchenko. 2012. Pharmaleaks: Understanding the business of online pharmaceutical affiliate programs. In Proc. USENIX Security’12, Bellevue, WA, Aug. 2012.
Measham, F. 2011. ‘Legal highs: The challenge for government.’ Criminal Justice Matters 84: 28–30.
Measham, F. 2013. ‘Social Issues in the Use of Novel Psychoactive Substances: Differentiated Demand and Ideological Supply.’ In Novel Psychoactive Substances: Classification, Pharmacology and Toxicology, edited by P.I. Dargan & D.M. Wood, 105-127. London: Academic Press.
Measham, F., K. Moore, & J. Ostergaard. 2011. Emerging Drug Trends in Lancashire: Night Time Economy Surveys. Dept of Applied Social Science, Lancaster University, UK
Meiklejohn, S., M. Pomarole, G. Jordan, K. Levchenko, D. Mccoy, G.M. Voelker, & S. Savage. 2013. A fistful of bitcoins: characterizing payments among men with no names. Proceedings of the ACM/USENIX Internet measurement conference (Barcelona, Spain, Oct. 2013), 127–140.
76 This article could not be accessed by the study team. 77 This article could not be accessed by the study team.
156 Internet-facilitated drugs trade RAND Europe
Miller, P. G., & Sønderlund, A. L. 2010. Using the internet to research hidden populations of illicit drug users: A review. Addiction 105, 1557–1567
Molnar, D., S. Egelman & N. Christin. 2010. This is your data on drugs: Lessons computer security can learn from the drug war. In Proc. NSPW’10, Concord, NH, Sept. 2010.
Motoyama, M., D. McCoy, K. Levchenko, S. Savage & G.M. Voelker. 2011. An analysis of underground forums. Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference, Germany
Motoyama, M., D. McCoy, K. Levchenko, S. Savage & G. Voelker. 2011. An analysis of underground forums. In Proc. ACM IMC’11, Berlin, Germany, Nov. 2011.
Murguía, E., & M. Tackett-Gibson. 2007.’ The new drugs internet survey: A portrait of respondents.’ In Real drugs in a virtual world: Drug discourse and community online, edited by E. Murguía, M. Tackett- Gibson & A. Lessem, 45–58. Lanham, MD: Lexington Books.
Nakamoto, S. 2008. Bitcoin: a peer-to-peer electronic cash system. As of 23 June 2016 : http://bitcoin.org/bitcoin.pdf
Nielsen, M. 2013. ‘How the Bitcoin protocol actually works.’ As of 23 June 2016: http://www.michaelnielsen.org/ddi/how-the-bitcoin-protocol-actually-works/
O, Brien, M. 2014. ‘The Internet, child pornography and cloud computing: the dark side of the web.’ Information & Communications Technology Law 23(3):238-255.
OFDT. n.d. Organisation et fonctionnement. As of 23 June 2016 : http://www.ofdt.fr/enquetes/trend- sintes/
OFDT. n.d. Publications issues du dispositif TREND. As of 23 June 2016 : http://www.ofdt.fr/enquetes/trend-sintes/notes-sintes/
Orizio, G., A. Merla, P.J. Schulz, U. Gelati. 2011. ‘Quality of online pharmacies and websites selling prescription drugs: a systematic review’. Journal of Medical Internet Research 13: e74.
Ormsby, E. 2013. ‘The Fall of Atlantis – a Moderator tells’. As of 23 June 2016 : http://allthingsvice.com/2013/09/26/the-fall-of-atlantis-a-moderator-tells/#more-461
Orsolini, L., G. Duccio Papanti, G. Francesconi & F. Schifano. 2015. ‘Mind Navigators of Chemicals’ Experimenters? A Web-Based Description of E-Psychonauts. Cyberpsychology,’ Behavior and Social Networking 18 (5):296-300.
Paper read at ACM Conference on Computer and Communications Security, at Alexandria, Virginia, USA
Power, M. 2013. Drug 2.0: The web revolution that's changing how the world get's high. London: Portobello.
Project T. 2011. ‘Anonymity online.’ As of 23 June 2016: https://www.torproject.org ( archived at http://www.webcitation.org/62jq3Psag).
157 RAND Europe Internet-facilitated drugs trade
Reid, F.& M. Harrigan. 2012. ‘An analysis of anonymity in the Bitcoin system.’ As of 23 June 2016: http://arxiv.org/abs/1107.4524
Scammell, Lynda & Alessandra Bo. 2016. ‘Online supply of medicines to illicit drug markets: situation and responses.’ In The Internet and drug markets, edited by EMCDDA, 107-114. Lisbon: EMCDDA.
Schifano, F. 2010. European-wide digital early warning system. As of 23 June 2016: http://vuh-la- risprt.herts.ac.uk/portal/en/projects/europeanwide-digital-early-warning-system(a3ed7586-a042-4f1a- a277-a79bddfa065b).html
Schifano, F.& O. Corazza. 2011. REDNet - Recreational Drugs' European Network: an ICT prevention service addressing the use of novel compounds in vulnerable individuals. As of 23 June 2016: http://vuh- la-risprt.herts.ac.uk/portal/en/projects/rednet--recreational-drugs-european-network-an-ict- prevention-service-addressing-the-use-of-novel-compounds-in-vulnerable-individuals(6e52381a-6ef2- 47f1-b1a6-98a889d621f5).html
Schifano, F. & O. Corazza. 2013. Analysis of the substances available on the Internet, the consumer profile, ways of buying online. As of 4 January 2016: http://vuh-la- risprt.herts.ac.uk/portal/en/projects/analysis-of-the-substances-available-on-the-internet-the- consumer-profile-ways-of-buying-online(24e26734-0b14-4f9b-8609-6cecb57c7f43).html
Schifano, F. and Corkery, J. 2012. Analyse the data sources, numbers and characteristics of cocaine-related DRD cases reported in special mortality registries, or eventually General Mortality Registries (GMR) when necessary. As of 23 June 2016: http://vuh-la-risprt.herts.ac.uk/portal/en/projects/analyse-the-data- sources-numbers-and-characteristics-of-cocainerelated-drd-cases-reported-in-special-mortality- registries-or-eventually-general-mortality-registries-gmr-when-necessary(32b007ed-2e1d-40f4-91aa- c46983994ae6).html
Schifano, F., J. Corkery & J. Stair. 2014-2016. EU - MADNESS European-wide Monitoring, Analysis and knowledge Dissemination on Novel/Emerging Psychoactives) integrated EU NPS monitoring & profiling to prevent health harms and update professionals. As of 23 June 2016: http://vuh-la- risprt.herts.ac.uk/portal/en/projects/eu--madness-europeanwide-monitoring-analysis-and-knowledge- dissemination-on-novelemerging-psychoactives-integrated-eu-nps-monitoring--profiling-to-prevent- health-harms-and-update-professionals(54abb26a-6eaa-4a27-afed-127967999bef).html
Schifano, F., J. Corkery & J. Stair. 2015-2016. Enhancing Police Skills concerning Novel Psychoactive Substances (NPS). As of 23 June 2016: http://vuh-la-risprt.herts.ac.uk/portal/en/projects/enhancing- police-skills-concerning-novel-psychoactive-substances-nps(938141a1-8cee-427f-b48d- 7f24c76d17c5).html
Schifano, F., A. Ricciardi, O. Corazza, P. Deluca, Z. Davey & C. Rafanelli. 2010. ‘New drugs of abuse on the Web: the role of the Psychonaut Web Mapping Project.’ Rivista di Psichiatria 45 (2):88-93.
Seddon, T. 2008. ‘Drugs, the informal economy and globalization.’ Economics 35: 717-728.
SICH Project. 2015. SICH Project - Final Conference. As of 23 June 2016: http://www.sichproject.eu/files/finalConference/SICH%20Final%20Conference%20Agenda%20- %2020th%20November%202015_ENG.pdf
158 Internet-facilitated drugs trade RAND Europe
SICH Project. n.d. SICH flyer. As of 23 June 2016: http://www.sichproject.eu/files/ProjectSICHFlyer.pdf
Smith, S.W. & F.M. Garlich. 2013. ‘Availability and Supply of Novel Psychoactive Substances.’ In Novel Psychoactive Substances: Classification, Pharmacology and Toxicology, edited by P.I. Dargan & D.M. Wood, 55–77. London: Academic Press.
Stockley, M. 2015. Memex – DARPA’s search engine for the Dark Web. As of 23 June 2016: https://nakedsecurity.sophos.com/2015/02/16/memex-darpas-search-engine-for-the-dark-web/
Tor. 2011. Anonymity online. As of 23 June 2016 :https://www.torproject.org/
Tweede Kamer der Staten-Generaal. 2012/2013. Naar een veiliger samenleving. 28 684/nr. 363
Tweede Kamer der Staten-Generaal. 2015. Technische informatie over de publicatie Nationale Drug Monitor Jaarbericht 2015
Twomey, P. 2013. ‘Halting a Shift in the Paradigm: The Need for Bitcoin Regulation.’ Trinity College Law Review 16:67-90.
United States District Court, Southern District of New York. 2014. United States of America vs. Ross William Ulbricht, Feb. 2014. United States District Court, Southern District of New York. Indictment 14CRIM068.
United States District Court, Western District of Washington at Seattle. 2013. United States of America vs. Steven Lloyd Sadler and Jenna M. White, Nov. 2013. United States District Court, Western District of Washington at Seattle. Criminal Complaint MJ13-487
UNODC. 2005. World Drugs Report. Vienna: United Nations Office on Drugs and Crime
US Department of Justice. 2013, 2015. Three judicial documents relating to the Ulbrich Silk Road case. As of 23 June 2016: http://www.justice.gov/sites/default/files/usao- sdny/legacy/2015/03/25/Benthall,%20Blake%20Complaint.pdf and http://www.justice.gov/sites/default/files/usao-sdny/legacy/2015/03/25/Second%20Post- Complaint%20Protective%20Order%20-%20Silk%20Road.pdf and https://www.cs.columbia.edu/~smb/UlbrichtCriminalComplaint.pdf
Walsh, C. 2011. ‘Drugs, the internet and change.’ Journal of Psychoactive Drugs 43: 55-63.
Wax, P. M. 2002. ‘Just a click away: Recreational drug web sites on the internet’. Pediatrics. 109(6), e96.
Wieland, D. M., M.J. Halter & C. Levine. 2012. ‘Bath salts: they are not what you think.’ Journal of Psychosocial Nursing and Mental Health Services 50: 17–21.
Winstock, A. R., P. Griffiths & D. Stewart. 2001. ‘Drugs and the dance music scene: a survey of current drug use patterns among a sample of dance music enthusiasts in the UK.’ Drug Alcohol Depend 64: 9- 17.
Winstock, A. R., L.R. Mitcheson, P. Deluca , Z. Davey, O. Corazza & F. Schifano. 2011. ‘Mephedrone, new kid for the chop?’ Addiction 106: 154-61.
Winstock, A.R., Mitcheson, L. 2012. ‘New recreational drugs and the primary care approach to patients who use them.’ British Medical Journal 344: e2 88.
159 RAND Europe Internet-facilitated drugs trade
Winstock, A.R. & J.D. Ramsey. 2010. ‘Legal highs and the challenges for policy makers.’ Addiction 105:1685-7.
Wood, D., F. Measham & P. Dargan. 2012. ‘“Our favourite drug”: Prevalence of use and preference for mephedrone in the London night-time economy 1 year after control.’ Journal of Substance Use 17: 91–97.
160
Appendix E: List of interviewees
This appendix lists the individuals interviewed or otherwise consulted as part of this study. Those who consented have been named in alphabetical order; others have been anonymised by function and/or affiliation. In case interviewees preferred not to be listed at all, they have been omitted from this list.
Table E.1. List of interviewees
Name Institution Country
Anonymous NA NA
Anonymous NA NA
Anonymous UK’s National Crime Agency (email United Kingdom correspondence)
Anonymous Dienst Landelijke Recherche, Dutch Police The Netherlands
Anonymous Dienst Landelijke Recherche, Dutch Police The Netherlands
Ben van Scheppingen Dutch Police The Netherlands
Bert-Jan Kamstra FIOD The Netherlands
Daan van der Gouwe Trimbos Institute The Netherlands
Detective Inspector Stefan Kálmán Swedish Police Authority Sweden
Inge Philips Police The Netherlands
Dr James Martin Macquarie University Australia
Jane Mounteney EMCDDA EU (Portugal)
Jirko Patist, Officier van Justitie Landelijk parket The Netherlands
Koen Hermans Eurojust EU (The Netherlands)
Dr Laura Orsolini, MD, Psychiatrist, MSc University of Hertfordshire - United Kingdom Crim, member of the EU-MADNESS team Psychopharmacology, Drug Misuse and Novel and senior research assistant for the Psychoactive Substances Research Unit, School EPS/NPS project of Life and Medical Sciences
Magali Martinez, Head of project French Monitoring Centre for Drugs and Drug France Addiction (OFDT), Unit Emerging trends and new drugs (TREND)
161 RAND Europe Internet-facilitated drugs trade
Name Institution Country
Dr Monica Barratt NA Australia
Dr Nicolas Christin, Assistant Research Carnegie Mellon University United States Professor of Electrical and Computer Engineering and Engineering & Public Policy
Pim Takkenberg TNO The Netherlands
Ranieri Argentini Nederlands Forensisch Instituut The Netherlands
Sybren Kooistra NA The Netherlands
Two Agents French Customs Administration France
Two Operational Specialists National Crime Squad The Netherlands
162
Appendix F: Interview topic guide
Y M N Question Notes/Modifications
1. Opening We’d like to begin by asking some general questions about your professional background and expertise.
1.1. General questions
Can you begin by giving us a description of your role in this organisation and length in post?
For how long have you been working in the field of online drugs trade [or other relevant topic]? If applicable, ask to clarify if experience relates to dark
and/or clear net drugs trade.
2. Characteristics of online drugs trade We’d like to know more about the characteristics of online drugs trade (clear and dark net, where possible).
2.1. Cryptomarkets and other Internet-based marketplaces
As a starting point, it would be helpful if you could provide an overview of the cryptomarkets and other (clear net) Internet-based marketplaces that you are aware of (e.g. number of markets, whether this is dark or clear net, type of drugs sold, etc.)
What, if any, trends can be observed in the field of cryptomarkets and other Internet-based marketplaces where drugs are being traded? (E.g. policies on these websites, payments, types of drugs, advertisement, etc.)
In case respondent knows more about the clear net: • On what websites are drugs being traded on the clear net? • Could you explain how drugs are traded on the clear net? (e.g. modus operandi; type of websites, e.g. online pharmacies; how are these websites used (for selling drugs, for advertising drugs, as dark net entries, etc.); role of social media, etc.) • What types of drugs are being traded over the clear net? (e.g. illicit drugs versus (sometime legal) NPS; use of nicknames, etc.)
• What are the main countries of origin for the
163 RAND Europe Internet-facilitated drugs trade
drugs traded on the clear net? • In what volumes are the drugs offered? To what extent is this wholesale or retail? (prompt for potential of spreading the risk through buying small amounts) • How does the size of trade of different types of drugs relate to one another? • To what extent are supporting goods and services offered on those websites? • To what extent are the drugs offered in combination with other legal or illegal goods or services? If so, which ones?
What is known about the developers and administrators of such marketplaces and websites? (e.g. characteristics, modus operandi, individuals versus groups, etc.)
To what extent do cryptomarkets and other Internet- based marketplaces put restrictions on the drugs trade?
How does the payment of Internet-based drugs trade proceed? Are there any differences between dark net and clear net?
2.2. Vendors and other actors (e.g. administrators, couriers, etc.)
Could you describe the characteristics and modus operandi of the vendors involved in the trade of drugs on the Internet (dark versus clear net, if possible) and other actors such as administrators and couriers?
What is the role of the Dutch infrastructure and knowledge (e.g. Internet hosting) within these markets (clear/dark net)
(if not answered in previous question) What can be said about the characteristics of these vendors in terms of age, gender, country of origin, criminal antecedents, etc.?
What, if any, are the possible trends that occur in terms of the number of vendors involved in online drugs trade (dark/clear net) and their listings?
From what countries do vendors operate primarily?
To what countries are vendors willing to ship?
What is the modus operandi in the shipping of these drugs sold on
the (dark/clear) net? Does this vary per type of drugs?
2.3. Country of origin
164 Internet-facilitated drugs trade RAND Europe
What are the main countries of origin for the drugs traded on the dark/clear net?
Based on your experience, are there indications that the Netherlands is an important country of origin for drugs trade on the dark/clear
net?
2.4. Customers/buyers
Could you describe the characteristics and modus operandi of the customers/buyers involved in the trade of drugs on the Internet (dark versus clear net, if possible)?
(if not answered in previous question) What can be said about the characteristics of these customers/buyers in terms of age, gender, country of origin, criminal antecedents, etc.?
What, if any, are the possible trends that occur in terms of the characteristics of customers/buyers involved in online drugs trade (dark/clear net)?
What, if any, are the possible trends that occur in terms of the size of the population of customers/buyers in the Netherlands involved in online drugs trade (dark/clear net)?
(if not answered in previous question) Could you describe the customers/buyers’ modus operandi in buying and receiving of drugs
bought online (dark/clear net)?
3. Detection and intervention of online drugs trade We’d like to know more possible avenues for intervention of online drugs trade (clear and dark net).
3.1. Detection and intervention practices
To begin with, could you describe what detection/intervention practices are in place in your country (when interviewee is international expert, ask to specify for international/national practices s/he is familiar with)?
Are there are alternative techniques used instead of criminal investigation and prosecution, such as techniques that disturb criminal processes? (if possible refer to Dutch barrier model)
What parties/organisations are involved in these detection/intervention practices? (e.g. Police, Prosecution Service, Customs, international organisations, private sector organisations, etc.)
What, if any, possibilities are there to abolish the anonymity during the trade and distribution of drugs (not including the production processes)?
What barriers do law enforcers face in the Netherlands (and/or abroad, if applicable) in detection and prosecution of online drugs
trade? (e.g. legal barriers, practical barriers, etc.)
3.2. Examples of interventions
165 RAND Europe Internet-facilitated drugs trade
Could you describe one or two examples of interventions in online drugs trade you are aware of/was involved in? (e.g. description of interventions, name of market place, type of drugs seized, and if possible actors involved, etc.)
Who, if any, were the key partners involved in these interventions?
Could you describe the consequences of bringing down this/these marketplace(s)? To what extent did any substitution effects occur?
Are you aware of interventions used in other countries? If so, what are its key characteristics? (e.g. starting points, partners involved,
etc.)
3.3. Successes and challenges
Overall, based on your experience, what are the key successes and challenges in detection and intervention of online drugs trade?
Based on your experience, what could be a possible avenue for the Dutch government to tackle online drugs trade?
4. Additional or interview-specific questions (use space to write extra questions before or during interview)
5. Key Lessons and Closing Questions We’d now like to close the interview with a couple of more broadly-oriented questions about your experience in the field of online drugs trade
5.1. Key lessons
If you could offer two or three key lessons from your experience with dark/clear net research and/or detection/intervention practices, what would those lessons be?
If you could change one thing about dark/clear net research and/or detection/intervention practices, what would it be?
166 Internet-facilitated drugs trade RAND Europe
5.2. Contacts and documents
Do you have any suggestions for other people that would be relevant to interview for this research? Do you have relevant (policy) documents that you are able to share with us?
5.3. Closing Question
Is there anything you wish to comment on, that you haven’t had a chance to share during today’s interview?
167